Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Purchase Order.exe

Overview

General Information

Sample name:Purchase Order.exe
Analysis ID:1523569
MD5:4bf3c3730f87303d462d33cd7439d24e
SHA1:0b242ca2f09aca59d55bfcac3c6842d3b5ed2578
SHA256:3ef886ad71e5fc825b9b608b3f80ce2a3c3dafc0ecc1bc7dc9721c6855898bc6
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Contains functionality to detect sleep reduction / modifications
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64native
  • Purchase Order.exe (PID: 6304 cmdline: "C:\Users\user\Desktop\Purchase Order.exe" MD5: 4BF3C3730F87303D462D33CD7439D24E)
    • svchost.exe (PID: 3900 cmdline: "C:\Users\user\Desktop\Purchase Order.exe" MD5: B7C999040D80E5BF87886D70D992C51E)
      • RAVCpl64.exe (PID: 5340 cmdline: "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s MD5: 731FB4B2E5AFBCADAABB80D642E056AC)
        • expand.exe (PID: 4788 cmdline: "C:\Windows\SysWOW64\expand.exe" MD5: 544B0DBFF3F393BCE8BB9D815F532D51)
          • explorer.exe (PID: 5020 cmdline: C:\Windows\Explorer.EXE MD5: 5EA66FF5AE5612F921BC9DA23BAC95F7)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.4885525142.0000000004250000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000005.00000002.4885525142.0000000004250000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2be80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x13faf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000005.00000002.4885598668.00000000042A0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000005.00000002.4885598668.00000000042A0000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2be80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x13faf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      00000002.00000002.3339599911.0000000002F40000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Click to see the 3 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        2.2.svchost.exe.600000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          2.2.svchost.exe.600000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2f0a3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x171d2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          2.2.svchost.exe.600000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            2.2.svchost.exe.600000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2e2a3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x163d2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\Purchase Order.exe", CommandLine: "C:\Users\user\Desktop\Purchase Order.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Purchase Order.exe", ParentImage: C:\Users\user\Desktop\Purchase Order.exe, ParentProcessId: 6304, ParentProcessName: Purchase Order.exe, ProcessCommandLine: "C:\Users\user\Desktop\Purchase Order.exe", ProcessId: 3900, ProcessName: svchost.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\Purchase Order.exe", CommandLine: "C:\Users\user\Desktop\Purchase Order.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Purchase Order.exe", ParentImage: C:\Users\user\Desktop\Purchase Order.exe, ParentProcessId: 6304, ParentProcessName: Purchase Order.exe, ProcessCommandLine: "C:\Users\user\Desktop\Purchase Order.exe", ProcessId: 3900, ProcessName: svchost.exe

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: Purchase Order.exeReversingLabs: Detection: 31%
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.600000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.600000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000005.00000002.4885525142.0000000004250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.4885598668.00000000042A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.3339599911.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.3338743779.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Machine Learning detection for sample
            Source: Purchase Order.exeJoe Sandbox ML: detected
            Source: Purchase Order.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: Binary string: expand.pdb source: svchost.exe, 00000002.00000003.3307786096.0000000002C3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3307529501.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdbUGP source: Purchase Order.exe, 00000000.00000003.2475206794.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Purchase Order.exe, 00000000.00000003.2478113585.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3255295030.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3339721963.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3252572055.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3339721963.000000000332D000.00000040.00001000.00020000.00000000.sdmp, expand.exe, 00000005.00000002.4885822563.00000000044B0000.00000040.00001000.00020000.00000000.sdmp, expand.exe, 00000005.00000003.3341859494.0000000004301000.00000004.00000020.00020000.00000000.sdmp, expand.exe, 00000005.00000002.4885822563.00000000045DD000.00000040.00001000.00020000.00000000.sdmp, expand.exe, 00000005.00000003.3338856185.000000000415C000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: Purchase Order.exe, 00000000.00000003.2475206794.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Purchase Order.exe, 00000000.00000003.2478113585.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.3255295030.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3339721963.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3252572055.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3339721963.000000000332D000.00000040.00001000.00020000.00000000.sdmp, expand.exe, 00000005.00000002.4885822563.00000000044B0000.00000040.00001000.00020000.00000000.sdmp, expand.exe, 00000005.00000003.3341859494.0000000004301000.00000004.00000020.00020000.00000000.sdmp, expand.exe, 00000005.00000002.4885822563.00000000045DD000.00000040.00001000.00020000.00000000.sdmp, expand.exe, 00000005.00000003.3338856185.000000000415C000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: expand.pdbGCTL source: svchost.exe, 00000002.00000003.3307786096.0000000002C3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3307529501.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0044BD29 FindFirstFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,0_2_00475FE5
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0044BF8D FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
            Source: explorer.exe, 00000006.00000000.4818852400.000000000D8D9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7533683446.0000000009E4A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7539179240.000000000D8D9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4815046665.0000000009E4A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
            Source: explorer.exe, 00000006.00000000.4818852400.000000000D8D9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7533683446.0000000009E4A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7539179240.000000000D8D9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4815046665.0000000009E4A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
            Source: explorer.exe, 00000006.00000000.4818852400.000000000D8D9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7533683446.0000000009E4A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7539179240.000000000D8D9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4815046665.0000000009E4A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: explorer.exe, 00000006.00000002.7538704599.000000000D8BE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4818523594.000000000D8BE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crl
            Source: explorer.exe, 00000006.00000002.7535770556.000000000AC50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.4810489818.00000000015C0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.7534939116.000000000A1D0000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
            Source: explorer.exe, 00000006.00000002.7532968534.0000000009CA7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4814522688.0000000009CA7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/odirm
            Source: explorer.exe, 00000006.00000000.4811153831.00000000037A0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7528175498.00000000037A0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
            Source: explorer.exe, 00000006.00000000.4811153831.00000000037A0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7528175498.00000000037A0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/;
            Source: explorer.exe, 00000006.00000002.7532753166.0000000009C04000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
            Source: explorer.exe, 00000006.00000000.4818523594.000000000D88C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7538704599.000000000D88C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=74FEDC5505D64D82A7BF425565317295&timeOut=5000&oc
            Source: explorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DC09251A71C5472DA2BDFD73DC109609&timeOut=5000&oc
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4818523594.000000000D88C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7538704599.000000000D88C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
            Source: explorer.exe, 00000006.00000000.4814714514.0000000009CB5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7533219203.0000000009CB5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.comI
            Source: explorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.c
            Source: explorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.ceath
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/taskbar/icons/index/svg/light/greenup.svg
            Source: explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/taskbar/icons/index/svg/light/reddown.svg
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/D200PartlySunnyV2.pn
            Source: explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/D200PartlySunnyV2.sv
            Source: explorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.que
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gAyL
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gAyL-dark
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gFtr
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gFtr-dark
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRoU
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRoU-dark
            Source: explorer.exe, 00000006.00000002.7539498768.000000000D927000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819076069.000000000D927000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
            Source: explorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA179X84.img
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1rx96r.img
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA3AZO2.img
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA6J22N.img
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAZhPUS.img
            Source: explorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAw0aqB.img
            Source: explorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAw0aqB.imgrofi
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBiuKxg.img
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBxWcHH.img
            Source: explorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.m
            Source: explorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.mdge/ntp?
            Source: explorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/edge/ntp?cm=e
            Source: explorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/edge/ntp?cm=e&oci
            Source: explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/edge/ntp?cm=en-us&ocid=widgetonlockscreenwin10&cvid=03f221f1-efc8-4ebc-bcdc-9c6b
            Source: explorer.exe, 00000006.00000002.7539498768.000000000D927000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819076069.000000000D927000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.comP51
            Source: explorer.exe, 00000006.00000002.7539498768.000000000D927000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819076069.000000000D927000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.comp
            Source: explorer.exe, 00000006.00000000.4818523594.000000000D88C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7538704599.000000000D88C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comEM
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://universalstore.streaming.mediaservices.windows.net/75db58d3-3007-4c4c-b2fc-8f6f86633a31/5aba
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-US&chosenMarketReason=ImplicitNew
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-US&chosenMarketReason=ImplicitNew
            Source: explorer.exe, 00000006.00000002.7539498768.000000000D927000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819076069.000000000D927000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/a36622721/everything-bagel-seasoning/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/g1590/easy-lunch-sandwiches/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/g39601341/breakfast-meal-prep-ideas/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/nutrition/g2599/healthy-dinner-salads/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/a22096112/copycat-chipotle-chicken-recipe/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/a26146740/ahi-poke-bowls/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/a27793321/chimichurri-sauce-recipe/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/a40022315/steak-grain-bowls-recipe/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/a40239263/philadelphia-roll-recipe/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/a40837113/caribbean-cobb-salad-recipe/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/a52078/crunchwrap-supreme-recipe/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/g1092/wrap-recipes/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/g2887/138-no-bake-desserts/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/g3026/fall-soup-recipes/
            Source: explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/g3034/quick-work-lunch-ideas/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/g32055698/how-to-make-leftovers-more-exciting/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/g3219/copycat-recipes/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/g3338/best-weeknight-dinners/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/recipes/a45873/copycat-olive-garden-zuppa-toscana-recipe
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/recipes/a46821/general-tsos-chicken-stir-fry-recipe/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/recipes/a49533/asian-lettuce-wraps-recipe/
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.delish.com/cooking/recipe-ideas/recipes/a54961/chicken-caesar-wraps-recipe/
            Source: explorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/channel/source/AZ%20Animals%20US/sr-vid-7etr9q8xun
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/feed
            Source: explorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/foodanddrink/cookingschool/for-the-best-grilled-clams-avoid-this-fatal-mis
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/foodanddrink/recipes/i-asked-3-butchers-how-to-choose-the-best-steak-they-
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/celeb-style/the-21-best-red-carpet-fashion-moments-of-all-time/s
            Source: explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/tracee-ellis-ross-wedge-ponytail-is-a-new-way-to-
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/pets/these-are-the-largest-reptiles-still-living-in-the-u-s/ss-B
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/companies/charles-schwab-names-president-rick-wurster-as-next-ceo/ar
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/companies/microsoft-exec-tells-staff-there-won-t-be-an-amazon-style-
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/companies/pepsico-to-buy-tortilla-chip-maker-siete-foods-for-1-2-bil
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/ask-the-builder-asphalt-shingle-alternatives/ar-AA1rjlsz
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/movies/news/robert-downey-jr-beams-as-he-makes-his-broadway-bow-on-opening
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/can-kamala-harris-beat-donald-trump-latest-poll-updates/ar-A
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/n-c-presidential-race-close-as-helene-recovery-begins-post-p
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/microsoft-reveals-windows-11-s-ai-roadmap-smart-search-ups
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/a-former-hostage-fought-for-her-own-life-in-gaza-a-year-on-she-
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/prince-william-joins-david-beckham-in-the-cockpit-for-helicopte
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/russia-secures-biggest-victory-since-february-as-it-captures-uk
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/nfl/miami-dolphins-mike-mcdaniel-draws-line-knows-things-must-chang
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/ohio-state-women-s-basketball-freshman-ava-watson-s-ability-t
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/tv/news/arsenio-hall-net-worth-a-closer-look-at-the-comedian-s-wealth/ar-A
            Source: explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/tv/news/frank-fritz-american-pickers-co-host-dies-at-60/ar-AA1rxfcm
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,0_2_00456354
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C08E

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.600000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.600000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000005.00000002.4885525142.0000000004250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.4885598668.00000000042A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.3339599911.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.3338743779.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 2.2.svchost.exe.600000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 2.2.svchost.exe.600000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000005.00000002.4885525142.0000000004250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000005.00000002.4885598668.00000000042A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.3339599911.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.3338743779.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Initial sample is a PE file and has a suspicious name
            Source: initial sampleStatic PE information: Filename: Purchase Order.exe
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0062C383 NtClose,2_2_0062C383
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00601857 NtProtectVirtualMemory,2_2_00601857
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272BC0 NtQueryInformationToken,LdrInitializeThunk,2_2_03272BC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272A80 NtClose,LdrInitializeThunk,2_2_03272A80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272EB0 NtProtectVirtualMemory,LdrInitializeThunk,2_2_03272EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272D10 NtQuerySystemInformation,LdrInitializeThunk,2_2_03272D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032734E0 NtCreateMutant,LdrInitializeThunk,2_2_032734E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03274260 NtSetContextThread,2_2_03274260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03274570 NtSuspendThread,2_2_03274570
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272B20 NtQueryInformationProcess,2_2_03272B20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272B00 NtQueryValueKey,2_2_03272B00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272B10 NtAllocateVirtualMemory,2_2_03272B10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272B80 NtCreateKey,2_2_03272B80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272B90 NtFreeVirtualMemory,2_2_03272B90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272BE0 NtQueryVirtualMemory,2_2_03272BE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272A10 NtWriteFile,2_2_03272A10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272AA0 NtQueryInformationFile,2_2_03272AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272AC0 NtEnumerateValueKey,2_2_03272AC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032729F0 NtReadFile,2_2_032729F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032729D0 NtWaitForSingleObject,2_2_032729D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272F30 NtOpenDirectoryObject,2_2_03272F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272F00 NtCreateFile,2_2_03272F00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272FB0 NtSetValueKey,2_2_03272FB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272E00 NtQueueApcThread,2_2_03272E00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272E50 NtCreateSection,2_2_03272E50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272E80 NtCreateProcessEx,2_2_03272E80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272EC0 NtQuerySection,2_2_03272EC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272ED0 NtResumeThread,2_2_03272ED0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272D50 NtWriteVirtualMemory,2_2_03272D50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272DA0 NtReadVirtualMemory,2_2_03272DA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272DC0 NtAdjustPrivilegesToken,2_2_03272DC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272C20 NtSetInformationFile,2_2_03272C20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272C30 NtMapViewOfSection,2_2_03272C30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272C10 NtOpenProcess,2_2_03272C10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272C50 NtUnmapViewOfSection,2_2_03272C50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272CF0 NtDelayExecution,2_2_03272CF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272CD0 NtEnumerateKey,2_2_03272CD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032738D0 NtGetContextThread,2_2_032738D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03273C30 NtOpenProcessToken,2_2_03273C30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03273C90 NtOpenThread,2_2_03273C90
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00434D50: GetFullPathNameW,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004461ED DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_004461ED
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00409A400_2_00409A40
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004120380_2_00412038
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004271610_2_00427161
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0047E1FA0_2_0047E1FA
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004212BE0_2_004212BE
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004433900_2_00443390
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004433910_2_00443391
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0041A46B0_2_0041A46B
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0041240C0_2_0041240C
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004465660_2_00446566
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004045E00_2_004045E0
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0041D7500_2_0041D750
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004037E00_2_004037E0
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004278590_2_00427859
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004128180_2_00412818
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0040F8900_2_0040F890
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0042397B0_2_0042397B
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00411B630_2_00411B63
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0047CBF00_2_0047CBF0
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0044EBBC0_2_0044EBBC
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00412C380_2_00412C38
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0044ED9A0_2_0044ED9A
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00423EBF0_2_00423EBF
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00424F700_2_00424F70
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0041AF0D0_2_0041AF0D
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_045657280_2_04565728
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006183632_2_00618363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006019412_2_00601941
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0062E9932_2_0062E993
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00602AC02_2_00602AC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00602AB32_2_00602AB3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006023402_2_00602340
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0060FBFE2_2_0060FBFE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0060FC032_2_0060FC03
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006165432_2_00616543
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0061653E2_2_0061653E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0060FE232_2_0060FE23
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006026A02_2_006026A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0060DEA32_2_0060DEA3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00602FA02_2_00602FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E3102_2_0324E310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032022452_2_03202245
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0330010E2_2_0330010E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EE0762_2_032EE076
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032300A02_2_032300A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324A7602_2_0324A760
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032427602_2_03242760
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F67572_2_032F6757
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325C6002_2_0325C600
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032646702_2_03264670
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032406802_2_03240680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323C6E02_2_0323C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FA6C02_2_032FA6C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0330A5262_2_0330A526
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032404452_2_03240445
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240B102_2_03240B10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B4BC02_2_032B4BC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FCA132_2_032FCA13
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FEA5B2_2_032FEA5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E2AC02_2_032E2AC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323E9A02_2_0323E9A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FE9A62_2_032FE9A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E08352_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E8102_2_0326E810
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032268682_2_03226868
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032568822_2_03256882
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DC89F2_2_032DC89F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C02_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324CF002_2_0324CF00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FEFBF2_2_032FEFBF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03246FE02_2_03246FE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0E6D2_2_032E0E6D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03282E482_2_03282E48
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03260E502_2_03260E50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F0EAD2_2_032F0EAD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03232EE82_2_03232EE8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323AD002_2_0323AD00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240D692_2_03240D69
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252DB02_2_03252DB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324AC202_2_0324AC20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BEC202_2_032BEC20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230C122_2_03230C12
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F6C692_2_032F6C69
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FEC602_2_032FEC60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EEC4C2_2_032EEC4C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0330ACEB2_2_0330ACEB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03258CDF2_2_03258CDF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FF3302_2_032FF330
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032313802_2_03231380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F124C2_2_032F124C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322D2EC2_2_0322D2EC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DD1302_2_032DD130
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322F1132_2_0322F113
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0328717A2_2_0328717A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325B1E02_2_0325B1E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032451C02_2_032451C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327508C2_2_0327508C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F70F12_2_032F70F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324B0D02_2_0324B0D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032017072_2_03201707
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DD62C2_2_032DD62C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E16232_2_032E1623
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032ED6462_2_032ED646
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B36EC2_2_032B36EC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FF6F62_2_032FF6F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FF5C92_2_032FF5C9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F75C62_2_032F75C6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AD4802_2_032AD480
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D54902_2_032D5490
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FFB2E2_2_032FFB2E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327DB192_2_0327DB19
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D1B802_2_032D1B80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325FAA02_2_0325FAA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FFA892_2_032FFA89
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032099E82_2_032099E8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032859C02_2_032859C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032438002_2_03243800
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032498702_2_03249870
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325B8702_2_0325B870
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B58702_2_032B5870
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FF8722_2_032FF872
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B98B22_2_032B98B2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F78F32_2_032F78F3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F18DA2_2_032F18DA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FFF632_2_032FFF63
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BFF402_2_032BFF40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E3FA02_2_032E3FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F1FC62_2_032F1FC6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03241EB22_2_03241EB2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F9ED22_2_032F9ED2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FFD272_2_032FFD27
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F3D222_2_032F3D22
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F7D4C2_2_032F7D4C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DFDF42_2_032DFDF4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03249DD02_2_03249DD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03243C602_2_03243C60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D9C982_2_032D9C98
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C7CE82_2_032C7CE8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325FCE02_2_0325FCE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03287BE4 appears 99 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03275050 appears 57 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 032BEF10 appears 105 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0322B910 appears 280 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 032AE692 appears 86 times
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: String function: 00445975 appears 65 times
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: String function: 0041171A appears 37 times
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: String function: 0041718C appears 45 times
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: String function: 0040E6D0 appears 35 times
            Source: Purchase Order.exe, 00000000.00000003.2476458487.0000000004C93000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Purchase Order.exe
            Source: Purchase Order.exe, 00000000.00000003.2476800620.0000000004E3D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Purchase Order.exe
            Source: Purchase Order.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: 2.2.svchost.exe.600000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 2.2.svchost.exe.600000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000005.00000002.4885525142.0000000004250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000005.00000002.4885598668.00000000042A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.3339599911.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.3338743779.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: classification engineClassification label: mal100.troj.evad.winEXE@5/1@0/0
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_0043701F
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0043614F FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
            Source: C:\Users\user\Desktop\Purchase Order.exeFile created: C:\Users\user\AppData\Local\Temp\HymenophyllaceaeJump to behavior
            Source: Purchase Order.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\Purchase Order.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: Purchase Order.exeReversingLabs: Detection: 31%
            Source: C:\Users\user\Desktop\Purchase Order.exeFile read: C:\Users\user\Desktop\Purchase Order.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\Purchase Order.exe "C:\Users\user\Desktop\Purchase Order.exe"
            Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Purchase Order.exe"
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeProcess created: C:\Windows\SysWOW64\expand.exe "C:\Windows\SysWOW64\expand.exe"
            Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Purchase Order.exe"Jump to behavior
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeProcess created: C:\Windows\SysWOW64\expand.exe "C:\Windows\SysWOW64\expand.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: edgegdi.dllJump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: edgegdi.dllJump to behavior
            Source: C:\Windows\SysWOW64\expand.exeSection loaded: cabinet.dllJump to behavior
            Source: C:\Windows\SysWOW64\expand.exeSection loaded: edgegdi.dllJump to behavior
            Source: C:\Windows\SysWOW64\expand.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: storageusage.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: fhcfg.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: efsutil.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dsrole.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: windows.internal.system.userprofile.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cloudexperiencehostbroker.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: credui.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dui70.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wdscore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dbghelp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dbgcore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: mfsrcsnk.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
            Source: Purchase Order.exeStatic file information: File size 1341549 > 1048576
            Source: Binary string: expand.pdb source: svchost.exe, 00000002.00000003.3307786096.0000000002C3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3307529501.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdbUGP source: Purchase Order.exe, 00000000.00000003.2475206794.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Purchase Order.exe, 00000000.00000003.2478113585.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3255295030.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3339721963.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3252572055.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3339721963.000000000332D000.00000040.00001000.00020000.00000000.sdmp, expand.exe, 00000005.00000002.4885822563.00000000044B0000.00000040.00001000.00020000.00000000.sdmp, expand.exe, 00000005.00000003.3341859494.0000000004301000.00000004.00000020.00020000.00000000.sdmp, expand.exe, 00000005.00000002.4885822563.00000000045DD000.00000040.00001000.00020000.00000000.sdmp, expand.exe, 00000005.00000003.3338856185.000000000415C000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: Purchase Order.exe, 00000000.00000003.2475206794.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Purchase Order.exe, 00000000.00000003.2478113585.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.3255295030.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3339721963.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3252572055.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3339721963.000000000332D000.00000040.00001000.00020000.00000000.sdmp, expand.exe, 00000005.00000002.4885822563.00000000044B0000.00000040.00001000.00020000.00000000.sdmp, expand.exe, 00000005.00000003.3341859494.0000000004301000.00000004.00000020.00020000.00000000.sdmp, expand.exe, 00000005.00000002.4885822563.00000000045DD000.00000040.00001000.00020000.00000000.sdmp, expand.exe, 00000005.00000003.3338856185.000000000415C000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: expand.pdbGCTL source: svchost.exe, 00000002.00000003.3307786096.0000000002C3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3307529501.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: Purchase Order.exeStatic PE information: real checksum: 0xa2135 should be: 0x156728
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0061E91B push ss; iretd 2_2_0061E91C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006189BB push ebp; ret 2_2_006189BC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0061227F pushad ; ret 2_2_00612280
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00603220 push eax; ret 2_2_00603222
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0061EAA5 pushfd ; iretd 2_2_0061EAA7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0060CD11 push edx; ret 2_2_0060CD12
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00611518 push esi; iretd 2_2_00611519
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006145D7 push FFFFFFABh; ret 2_2_006145EB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00606617 push ebx; iretd 2_2_00606621
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0062D753 push edi; ret 2_2_0062D75C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0061E7F8 push 0000004Bh; retf 2_2_0061E801
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0061DF97 push cs; ret 2_2_0061DF98
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032021AD pushad ; retf 0004h2_2_0320223F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032308CD push ecx; mov dword ptr [esp], ecx2_2_032308D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032097A1 push es; iretd 2_2_032097A8
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Windows\SysWOW64\expand.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Contains functionality to detect sleep reduction / modifications
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004440780_2_00444078
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\Desktop\Purchase Order.exeAPI/Special instruction interceptor: Address: 456534C
            Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FF86B60D144
            Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FF86B610594
            Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FF86B60FF74
            Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FF86B60D6C4
            Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FF86B60D864
            Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FF86B60D004
            Source: C:\Windows\SysWOW64\expand.exeAPI/Special instruction interceptor: Address: 7FF86B60D144
            Source: C:\Windows\SysWOW64\expand.exeAPI/Special instruction interceptor: Address: 7FF86B610594
            Source: C:\Windows\SysWOW64\expand.exeAPI/Special instruction interceptor: Address: 7FF86B60D764
            Source: C:\Windows\SysWOW64\expand.exeAPI/Special instruction interceptor: Address: 7FF86B60D324
            Source: C:\Windows\SysWOW64\expand.exeAPI/Special instruction interceptor: Address: 7FF86B60D364
            Source: C:\Windows\SysWOW64\expand.exeAPI/Special instruction interceptor: Address: 7FF86B60D004
            Source: C:\Windows\SysWOW64\expand.exeAPI/Special instruction interceptor: Address: 7FF86B60FF74
            Source: C:\Windows\SysWOW64\expand.exeAPI/Special instruction interceptor: Address: 7FF86B60D6C4
            Source: C:\Windows\SysWOW64\expand.exeAPI/Special instruction interceptor: Address: 7FF86B60D864
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327088E rdtsc 2_2_0327088E
            Source: C:\Windows\SysWOW64\expand.exeWindow / User API: threadDelayed 9852Jump to behavior
            Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 882Jump to behavior
            Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 878Jump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeAPI coverage: 3.1 %
            Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.8 %
            Source: C:\Windows\SysWOW64\expand.exe TID: 5716Thread sleep count: 122 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\expand.exe TID: 5716Thread sleep time: -244000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\expand.exe TID: 5716Thread sleep count: 9852 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\expand.exe TID: 5716Thread sleep time: -19704000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\expand.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\expand.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0044BD29 FindFirstFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,0_2_00475FE5
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0044BF8D FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
            Source: explorer.exe, 00000006.00000002.7532753166.0000000009BE3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4814356361.0000000009BE3000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWROPq
            Source: explorer.exe, 00000006.00000002.7539179240.000000000D8C5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: explorer.exe, 00000006.00000000.4814356361.0000000009C04000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7532753166.0000000009C04000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-US\wmiacpi.inf_locL
            Source: expand.exe, 00000005.00000002.4885259332.0000000000734000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\expand.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\expand.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327088E rdtsc 2_2_0327088E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006174F3 LdrLoadDll,2_2_006174F3
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_045655B8 mov eax, dword ptr fs:[00000030h]0_2_045655B8
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_04565618 mov eax, dword ptr fs:[00000030h]0_2_04565618
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_04563F68 mov eax, dword ptr fs:[00000030h]0_2_04563F68
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03268322 mov eax, dword ptr fs:[00000030h]2_2_03268322
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03268322 mov eax, dword ptr fs:[00000030h]2_2_03268322
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03268322 mov eax, dword ptr fs:[00000030h]2_2_03268322
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322E328 mov eax, dword ptr fs:[00000030h]2_2_0322E328
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322E328 mov eax, dword ptr fs:[00000030h]2_2_0322E328
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322E328 mov eax, dword ptr fs:[00000030h]2_2_0322E328
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E4320 mov eax, dword ptr fs:[00000030h]2_2_032E4320
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D630E mov eax, dword ptr fs:[00000030h]2_2_032D630E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E310 mov eax, dword ptr fs:[00000030h]2_2_0324E310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E310 mov eax, dword ptr fs:[00000030h]2_2_0324E310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E310 mov eax, dword ptr fs:[00000030h]2_2_0324E310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326631F mov eax, dword ptr fs:[00000030h]2_2_0326631F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E363 mov eax, dword ptr fs:[00000030h]2_2_0326E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E363 mov eax, dword ptr fs:[00000030h]2_2_0326E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E363 mov eax, dword ptr fs:[00000030h]2_2_0326E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E363 mov eax, dword ptr fs:[00000030h]2_2_0326E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E363 mov eax, dword ptr fs:[00000030h]2_2_0326E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E363 mov eax, dword ptr fs:[00000030h]2_2_0326E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E363 mov eax, dword ptr fs:[00000030h]2_2_0326E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E363 mov eax, dword ptr fs:[00000030h]2_2_0326E363
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE372 mov eax, dword ptr fs:[00000030h]2_2_032AE372
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE372 mov eax, dword ptr fs:[00000030h]2_2_032AE372
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE372 mov eax, dword ptr fs:[00000030h]2_2_032AE372
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE372 mov eax, dword ptr fs:[00000030h]2_2_032AE372
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B0371 mov eax, dword ptr fs:[00000030h]2_2_032B0371
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B0371 mov eax, dword ptr fs:[00000030h]2_2_032B0371
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325237A mov eax, dword ptr fs:[00000030h]2_2_0325237A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03228347 mov eax, dword ptr fs:[00000030h]2_2_03228347
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03228347 mov eax, dword ptr fs:[00000030h]2_2_03228347
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03228347 mov eax, dword ptr fs:[00000030h]2_2_03228347
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A350 mov eax, dword ptr fs:[00000030h]2_2_0326A350
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D43BA mov eax, dword ptr fs:[00000030h]2_2_032D43BA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D43BA mov eax, dword ptr fs:[00000030h]2_2_032D43BA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AC3B0 mov eax, dword ptr fs:[00000030h]2_2_032AC3B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325A390 mov eax, dword ptr fs:[00000030h]2_2_0325A390
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325A390 mov eax, dword ptr fs:[00000030h]2_2_0325A390
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325A390 mov eax, dword ptr fs:[00000030h]2_2_0325A390
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322E3C0 mov eax, dword ptr fs:[00000030h]2_2_0322E3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322E3C0 mov eax, dword ptr fs:[00000030h]2_2_0322E3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322E3C0 mov eax, dword ptr fs:[00000030h]2_2_0322E3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322C3C7 mov eax, dword ptr fs:[00000030h]2_2_0322C3C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032363CB mov eax, dword ptr fs:[00000030h]2_2_032363CB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032643D0 mov ecx, dword ptr fs:[00000030h]2_2_032643D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BE3DD mov eax, dword ptr fs:[00000030h]2_2_032BE3DD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B43D5 mov eax, dword ptr fs:[00000030h]2_2_032B43D5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B0227 mov eax, dword ptr fs:[00000030h]2_2_032B0227
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B0227 mov eax, dword ptr fs:[00000030h]2_2_032B0227
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B0227 mov eax, dword ptr fs:[00000030h]2_2_032B0227
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A22B mov eax, dword ptr fs:[00000030h]2_2_0326A22B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A22B mov eax, dword ptr fs:[00000030h]2_2_0326A22B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A22B mov eax, dword ptr fs:[00000030h]2_2_0326A22B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03250230 mov ecx, dword ptr fs:[00000030h]2_2_03250230
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322A200 mov eax, dword ptr fs:[00000030h]2_2_0322A200
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322821B mov eax, dword ptr fs:[00000030h]2_2_0322821B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032542AF mov eax, dword ptr fs:[00000030h]2_2_032542AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032542AF mov eax, dword ptr fs:[00000030h]2_2_032542AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322C2B0 mov ecx, dword ptr fs:[00000030h]2_2_0322C2B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE289 mov eax, dword ptr fs:[00000030h]2_2_032AE289
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A2E0 mov eax, dword ptr fs:[00000030h]2_2_0323A2E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A2E0 mov eax, dword ptr fs:[00000030h]2_2_0323A2E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A2E0 mov eax, dword ptr fs:[00000030h]2_2_0323A2E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A2E0 mov eax, dword ptr fs:[00000030h]2_2_0323A2E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A2E0 mov eax, dword ptr fs:[00000030h]2_2_0323A2E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A2E0 mov eax, dword ptr fs:[00000030h]2_2_0323A2E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032382E0 mov eax, dword ptr fs:[00000030h]2_2_032382E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032382E0 mov eax, dword ptr fs:[00000030h]2_2_032382E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032382E0 mov eax, dword ptr fs:[00000030h]2_2_032382E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032382E0 mov eax, dword ptr fs:[00000030h]2_2_032382E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032402F9 mov eax, dword ptr fs:[00000030h]2_2_032402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032402F9 mov eax, dword ptr fs:[00000030h]2_2_032402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032402F9 mov eax, dword ptr fs:[00000030h]2_2_032402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032402F9 mov eax, dword ptr fs:[00000030h]2_2_032402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032402F9 mov eax, dword ptr fs:[00000030h]2_2_032402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032402F9 mov eax, dword ptr fs:[00000030h]2_2_032402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032402F9 mov eax, dword ptr fs:[00000030h]2_2_032402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032402F9 mov eax, dword ptr fs:[00000030h]2_2_032402F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BA130 mov eax, dword ptr fs:[00000030h]2_2_032BA130
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03260118 mov eax, dword ptr fs:[00000030h]2_2_03260118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236179 mov eax, dword ptr fs:[00000030h]2_2_03236179
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322A147 mov eax, dword ptr fs:[00000030h]2_2_0322A147
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322A147 mov eax, dword ptr fs:[00000030h]2_2_0322A147
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322A147 mov eax, dword ptr fs:[00000030h]2_2_0322A147
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326415F mov eax, dword ptr fs:[00000030h]2_2_0326415F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E1A4 mov eax, dword ptr fs:[00000030h]2_2_0326E1A4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E1A4 mov eax, dword ptr fs:[00000030h]2_2_0326E1A4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032641BB mov ecx, dword ptr fs:[00000030h]2_2_032641BB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032641BB mov eax, dword ptr fs:[00000030h]2_2_032641BB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032641BB mov eax, dword ptr fs:[00000030h]2_2_032641BB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03234180 mov eax, dword ptr fs:[00000030h]2_2_03234180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03234180 mov eax, dword ptr fs:[00000030h]2_2_03234180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03234180 mov eax, dword ptr fs:[00000030h]2_2_03234180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A1E3 mov eax, dword ptr fs:[00000030h]2_2_0323A1E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A1E3 mov eax, dword ptr fs:[00000030h]2_2_0323A1E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A1E3 mov eax, dword ptr fs:[00000030h]2_2_0323A1E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A1E3 mov eax, dword ptr fs:[00000030h]2_2_0323A1E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A1E3 mov eax, dword ptr fs:[00000030h]2_2_0323A1E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F81EE mov eax, dword ptr fs:[00000030h]2_2_032F81EE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F81EE mov eax, dword ptr fs:[00000030h]2_2_032F81EE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032281EB mov eax, dword ptr fs:[00000030h]2_2_032281EB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032401F1 mov eax, dword ptr fs:[00000030h]2_2_032401F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032401F1 mov eax, dword ptr fs:[00000030h]2_2_032401F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032401F1 mov eax, dword ptr fs:[00000030h]2_2_032401F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032401C0 mov eax, dword ptr fs:[00000030h]2_2_032401C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032401C0 mov eax, dword ptr fs:[00000030h]2_2_032401C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238009 mov eax, dword ptr fs:[00000030h]2_2_03238009
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EA01A mov eax, dword ptr fs:[00000030h]2_2_032EA01A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272010 mov ecx, dword ptr fs:[00000030h]2_2_03272010
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236074 mov eax, dword ptr fs:[00000030h]2_2_03236074
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236074 mov eax, dword ptr fs:[00000030h]2_2_03236074
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03260044 mov eax, dword ptr fs:[00000030h]2_2_03260044
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B6040 mov eax, dword ptr fs:[00000030h]2_2_032B6040
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032700A5 mov eax, dword ptr fs:[00000030h]2_2_032700A5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B60A0 mov eax, dword ptr fs:[00000030h]2_2_032B60A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B60A0 mov eax, dword ptr fs:[00000030h]2_2_032B60A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B60A0 mov eax, dword ptr fs:[00000030h]2_2_032B60A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B60A0 mov eax, dword ptr fs:[00000030h]2_2_032B60A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B60A0 mov eax, dword ptr fs:[00000030h]2_2_032B60A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B60A0 mov eax, dword ptr fs:[00000030h]2_2_032B60A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B60A0 mov eax, dword ptr fs:[00000030h]2_2_032B60A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304080 mov eax, dword ptr fs:[00000030h]2_2_03304080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304080 mov eax, dword ptr fs:[00000030h]2_2_03304080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304080 mov eax, dword ptr fs:[00000030h]2_2_03304080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304080 mov eax, dword ptr fs:[00000030h]2_2_03304080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304080 mov eax, dword ptr fs:[00000030h]2_2_03304080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304080 mov eax, dword ptr fs:[00000030h]2_2_03304080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304080 mov eax, dword ptr fs:[00000030h]2_2_03304080
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322A093 mov ecx, dword ptr fs:[00000030h]2_2_0322A093
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322C090 mov eax, dword ptr fs:[00000030h]2_2_0322C090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C6090 mov eax, dword ptr fs:[00000030h]2_2_032C6090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BC0E0 mov ecx, dword ptr fs:[00000030h]2_2_032BC0E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322C0F6 mov eax, dword ptr fs:[00000030h]2_2_0322C0F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E4730 mov eax, dword ptr fs:[00000030h]2_2_032E4730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E4730 mov eax, dword ptr fs:[00000030h]2_2_032E4730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325270D mov eax, dword ptr fs:[00000030h]2_2_0325270D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325270D mov eax, dword ptr fs:[00000030h]2_2_0325270D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325270D mov eax, dword ptr fs:[00000030h]2_2_0325270D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323471B mov eax, dword ptr fs:[00000030h]2_2_0323471B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323471B mov eax, dword ptr fs:[00000030h]2_2_0323471B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03242760 mov ecx, dword ptr fs:[00000030h]2_2_03242760
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03260774 mov eax, dword ptr fs:[00000030h]2_2_03260774
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03234779 mov eax, dword ptr fs:[00000030h]2_2_03234779
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03234779 mov eax, dword ptr fs:[00000030h]2_2_03234779
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252755 mov eax, dword ptr fs:[00000030h]2_2_03252755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252755 mov eax, dword ptr fs:[00000030h]2_2_03252755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252755 mov eax, dword ptr fs:[00000030h]2_2_03252755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252755 mov ecx, dword ptr fs:[00000030h]2_2_03252755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252755 mov eax, dword ptr fs:[00000030h]2_2_03252755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252755 mov eax, dword ptr fs:[00000030h]2_2_03252755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A750 mov eax, dword ptr fs:[00000030h]2_2_0326A750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE750 mov eax, dword ptr fs:[00000030h]2_2_032DE750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032307A7 mov eax, dword ptr fs:[00000030h]2_2_032307A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D47B4 mov eax, dword ptr fs:[00000030h]2_2_032D47B4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D47B4 mov eax, dword ptr fs:[00000030h]2_2_032D47B4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D47B4 mov eax, dword ptr fs:[00000030h]2_2_032D47B4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D47B4 mov eax, dword ptr fs:[00000030h]2_2_032D47B4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D47B4 mov eax, dword ptr fs:[00000030h]2_2_032D47B4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D47B4 mov eax, dword ptr fs:[00000030h]2_2_032D47B4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D47B4 mov ecx, dword ptr fs:[00000030h]2_2_032D47B4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032CC7B0 mov eax, dword ptr fs:[00000030h]2_2_032CC7B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032CC7B0 mov eax, dword ptr fs:[00000030h]2_2_032CC7B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE79D mov eax, dword ptr fs:[00000030h]2_2_032AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE79D mov eax, dword ptr fs:[00000030h]2_2_032AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE79D mov eax, dword ptr fs:[00000030h]2_2_032AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE79D mov eax, dword ptr fs:[00000030h]2_2_032AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE79D mov eax, dword ptr fs:[00000030h]2_2_032AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE79D mov eax, dword ptr fs:[00000030h]2_2_032AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE79D mov eax, dword ptr fs:[00000030h]2_2_032AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE79D mov eax, dword ptr fs:[00000030h]2_2_032AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE79D mov eax, dword ptr fs:[00000030h]2_2_032AE79D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E7E0 mov eax, dword ptr fs:[00000030h]2_2_0325E7E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C620 mov eax, dword ptr fs:[00000030h]2_2_0326C620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230630 mov eax, dword ptr fs:[00000030h]2_2_03230630
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03260630 mov eax, dword ptr fs:[00000030h]2_2_03260630
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B8633 mov esi, dword ptr fs:[00000030h]2_2_032B8633
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B8633 mov eax, dword ptr fs:[00000030h]2_2_032B8633
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B8633 mov eax, dword ptr fs:[00000030h]2_2_032B8633
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304600 mov eax, dword ptr fs:[00000030h]2_2_03304600
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326666D mov esi, dword ptr fs:[00000030h]2_2_0326666D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326666D mov eax, dword ptr fs:[00000030h]2_2_0326666D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326666D mov eax, dword ptr fs:[00000030h]2_2_0326666D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BE660 mov eax, dword ptr fs:[00000030h]2_2_032BE660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230670 mov eax, dword ptr fs:[00000030h]2_2_03230670
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272670 mov eax, dword ptr fs:[00000030h]2_2_03272670
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272670 mov eax, dword ptr fs:[00000030h]2_2_03272670
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C640 mov eax, dword ptr fs:[00000030h]2_2_0326C640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C640 mov eax, dword ptr fs:[00000030h]2_2_0326C640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326265C mov eax, dword ptr fs:[00000030h]2_2_0326265C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326265C mov ecx, dword ptr fs:[00000030h]2_2_0326265C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326265C mov eax, dword ptr fs:[00000030h]2_2_0326265C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F86A8 mov eax, dword ptr fs:[00000030h]2_2_032F86A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F86A8 mov eax, dword ptr fs:[00000030h]2_2_032F86A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240680 mov eax, dword ptr fs:[00000030h]2_2_03240680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240680 mov eax, dword ptr fs:[00000030h]2_2_03240680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240680 mov eax, dword ptr fs:[00000030h]2_2_03240680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240680 mov eax, dword ptr fs:[00000030h]2_2_03240680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240680 mov eax, dword ptr fs:[00000030h]2_2_03240680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240680 mov eax, dword ptr fs:[00000030h]2_2_03240680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240680 mov eax, dword ptr fs:[00000030h]2_2_03240680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240680 mov eax, dword ptr fs:[00000030h]2_2_03240680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240680 mov eax, dword ptr fs:[00000030h]2_2_03240680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240680 mov eax, dword ptr fs:[00000030h]2_2_03240680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240680 mov eax, dword ptr fs:[00000030h]2_2_03240680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240680 mov eax, dword ptr fs:[00000030h]2_2_03240680
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238690 mov eax, dword ptr fs:[00000030h]2_2_03238690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BC691 mov eax, dword ptr fs:[00000030h]2_2_032BC691
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323C6E0 mov eax, dword ptr fs:[00000030h]2_2_0323C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032566E0 mov eax, dword ptr fs:[00000030h]2_2_032566E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032566E0 mov eax, dword ptr fs:[00000030h]2_2_032566E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AC6F2 mov eax, dword ptr fs:[00000030h]2_2_032AC6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AC6F2 mov eax, dword ptr fs:[00000030h]2_2_032AC6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E46CB mov eax, dword ptr fs:[00000030h]2_2_032E46CB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E46CB mov eax, dword ptr fs:[00000030h]2_2_032E46CB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032306CF mov eax, dword ptr fs:[00000030h]2_2_032306CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FA6C0 mov eax, dword ptr fs:[00000030h]2_2_032FA6C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D86C2 mov eax, dword ptr fs:[00000030h]2_2_032D86C2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C66D0 mov eax, dword ptr fs:[00000030h]2_2_032C66D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C66D0 mov eax, dword ptr fs:[00000030h]2_2_032C66D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE6D0 mov eax, dword ptr fs:[00000030h]2_2_032DE6D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324252B mov eax, dword ptr fs:[00000030h]2_2_0324252B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324252B mov eax, dword ptr fs:[00000030h]2_2_0324252B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324252B mov eax, dword ptr fs:[00000030h]2_2_0324252B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324252B mov eax, dword ptr fs:[00000030h]2_2_0324252B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324252B mov eax, dword ptr fs:[00000030h]2_2_0324252B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324252B mov eax, dword ptr fs:[00000030h]2_2_0324252B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324252B mov eax, dword ptr fs:[00000030h]2_2_0324252B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272539 mov eax, dword ptr fs:[00000030h]2_2_03272539
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E507 mov eax, dword ptr fs:[00000030h]2_2_0325E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E507 mov eax, dword ptr fs:[00000030h]2_2_0325E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E507 mov eax, dword ptr fs:[00000030h]2_2_0325E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E507 mov eax, dword ptr fs:[00000030h]2_2_0325E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E507 mov eax, dword ptr fs:[00000030h]2_2_0325E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E507 mov eax, dword ptr fs:[00000030h]2_2_0325E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E507 mov eax, dword ptr fs:[00000030h]2_2_0325E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E507 mov eax, dword ptr fs:[00000030h]2_2_0325E507
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03232500 mov eax, dword ptr fs:[00000030h]2_2_03232500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C50D mov eax, dword ptr fs:[00000030h]2_2_0326C50D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C50D mov eax, dword ptr fs:[00000030h]2_2_0326C50D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BC51D mov eax, dword ptr fs:[00000030h]2_2_032BC51D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324C560 mov eax, dword ptr fs:[00000030h]2_2_0324C560
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E547 mov eax, dword ptr fs:[00000030h]2_2_0324E547
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03266540 mov eax, dword ptr fs:[00000030h]2_2_03266540
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03268540 mov eax, dword ptr fs:[00000030h]2_2_03268540
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323254C mov eax, dword ptr fs:[00000030h]2_2_0323254C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C6550 mov eax, dword ptr fs:[00000030h]2_2_032C6550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FA553 mov eax, dword ptr fs:[00000030h]2_2_032FA553
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B85AA mov eax, dword ptr fs:[00000030h]2_2_032B85AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032345B0 mov eax, dword ptr fs:[00000030h]2_2_032345B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032345B0 mov eax, dword ptr fs:[00000030h]2_2_032345B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE588 mov eax, dword ptr fs:[00000030h]2_2_032AE588
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE588 mov eax, dword ptr fs:[00000030h]2_2_032AE588
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A580 mov eax, dword ptr fs:[00000030h]2_2_0326A580
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A580 mov eax, dword ptr fs:[00000030h]2_2_0326A580
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03262594 mov eax, dword ptr fs:[00000030h]2_2_03262594
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BC592 mov eax, dword ptr fs:[00000030h]2_2_032BC592
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A5E7 mov ebx, dword ptr fs:[00000030h]2_2_0326A5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A5E7 mov eax, dword ptr fs:[00000030h]2_2_0326A5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE5E0 mov eax, dword ptr fs:[00000030h]2_2_032DE5E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BC5FC mov eax, dword ptr fs:[00000030h]2_2_032BC5FC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C5C6 mov eax, dword ptr fs:[00000030h]2_2_0326C5C6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B05C6 mov eax, dword ptr fs:[00000030h]2_2_032B05C6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032665D0 mov eax, dword ptr fs:[00000030h]2_2_032665D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C6400 mov eax, dword ptr fs:[00000030h]2_2_032C6400
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C6400 mov eax, dword ptr fs:[00000030h]2_2_032C6400
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322640D mov eax, dword ptr fs:[00000030h]2_2_0322640D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BE461 mov eax, dword ptr fs:[00000030h]2_2_032BE461
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FA464 mov eax, dword ptr fs:[00000030h]2_2_032FA464
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238470 mov eax, dword ptr fs:[00000030h]2_2_03238470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238470 mov eax, dword ptr fs:[00000030h]2_2_03238470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240445 mov eax, dword ptr fs:[00000030h]2_2_03240445
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240445 mov eax, dword ptr fs:[00000030h]2_2_03240445
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240445 mov eax, dword ptr fs:[00000030h]2_2_03240445
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240445 mov eax, dword ptr fs:[00000030h]2_2_03240445
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240445 mov eax, dword ptr fs:[00000030h]2_2_03240445
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240445 mov eax, dword ptr fs:[00000030h]2_2_03240445
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B0443 mov eax, dword ptr fs:[00000030h]2_2_032B0443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E45E mov eax, dword ptr fs:[00000030h]2_2_0325E45E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E45E mov eax, dword ptr fs:[00000030h]2_2_0325E45E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E45E mov eax, dword ptr fs:[00000030h]2_2_0325E45E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E45E mov eax, dword ptr fs:[00000030h]2_2_0325E45E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E45E mov eax, dword ptr fs:[00000030h]2_2_0325E45E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032324A2 mov eax, dword ptr fs:[00000030h]2_2_032324A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032324A2 mov ecx, dword ptr fs:[00000030h]2_2_032324A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032644A8 mov eax, dword ptr fs:[00000030h]2_2_032644A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C84BB mov eax, dword ptr fs:[00000030h]2_2_032C84BB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E4BC mov eax, dword ptr fs:[00000030h]2_2_0326E4BC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230485 mov ecx, dword ptr fs:[00000030h]2_2_03230485
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326648A mov eax, dword ptr fs:[00000030h]2_2_0326648A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326648A mov eax, dword ptr fs:[00000030h]2_2_0326648A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326648A mov eax, dword ptr fs:[00000030h]2_2_0326648A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BC490 mov eax, dword ptr fs:[00000030h]2_2_032BC490
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E4EF mov eax, dword ptr fs:[00000030h]2_2_0326E4EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E4EF mov eax, dword ptr fs:[00000030h]2_2_0326E4EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032364F0 mov eax, dword ptr fs:[00000030h]2_2_032364F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D44F8 mov eax, dword ptr fs:[00000030h]2_2_032D44F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D44F8 mov eax, dword ptr fs:[00000030h]2_2_032D44F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A4F0 mov eax, dword ptr fs:[00000030h]2_2_0326A4F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A4F0 mov eax, dword ptr fs:[00000030h]2_2_0326A4F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BE4F2 mov eax, dword ptr fs:[00000030h]2_2_032BE4F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BE4F2 mov eax, dword ptr fs:[00000030h]2_2_032BE4F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032544D1 mov eax, dword ptr fs:[00000030h]2_2_032544D1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032544D1 mov eax, dword ptr fs:[00000030h]2_2_032544D1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326CB20 mov eax, dword ptr fs:[00000030h]2_2_0326CB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BCB20 mov eax, dword ptr fs:[00000030h]2_2_032BCB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BCB20 mov eax, dword ptr fs:[00000030h]2_2_032BCB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BCB20 mov eax, dword ptr fs:[00000030h]2_2_032BCB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238B10 mov eax, dword ptr fs:[00000030h]2_2_03238B10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238B10 mov eax, dword ptr fs:[00000030h]2_2_03238B10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238B10 mov eax, dword ptr fs:[00000030h]2_2_03238B10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240B10 mov eax, dword ptr fs:[00000030h]2_2_03240B10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240B10 mov eax, dword ptr fs:[00000030h]2_2_03240B10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240B10 mov eax, dword ptr fs:[00000030h]2_2_03240B10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240B10 mov eax, dword ptr fs:[00000030h]2_2_03240B10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325EB1C mov eax, dword ptr fs:[00000030h]2_2_0325EB1C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322CB1E mov eax, dword ptr fs:[00000030h]2_2_0322CB1E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323AB70 mov eax, dword ptr fs:[00000030h]2_2_0323AB70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323AB70 mov eax, dword ptr fs:[00000030h]2_2_0323AB70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323AB70 mov eax, dword ptr fs:[00000030h]2_2_0323AB70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323AB70 mov eax, dword ptr fs:[00000030h]2_2_0323AB70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323AB70 mov eax, dword ptr fs:[00000030h]2_2_0323AB70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323AB70 mov eax, dword ptr fs:[00000030h]2_2_0323AB70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236B70 mov eax, dword ptr fs:[00000030h]2_2_03236B70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236B70 mov eax, dword ptr fs:[00000030h]2_2_03236B70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236B70 mov eax, dword ptr fs:[00000030h]2_2_03236B70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304B67 mov eax, dword ptr fs:[00000030h]2_2_03304B67
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E6B77 mov eax, dword ptr fs:[00000030h]2_2_032E6B77
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03264B79 mov eax, dword ptr fs:[00000030h]2_2_03264B79
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F8BBE mov eax, dword ptr fs:[00000030h]2_2_032F8BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F8BBE mov eax, dword ptr fs:[00000030h]2_2_032F8BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F8BBE mov eax, dword ptr fs:[00000030h]2_2_032F8BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F8BBE mov eax, dword ptr fs:[00000030h]2_2_032F8BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304BE0 mov eax, dword ptr fs:[00000030h]2_2_03304BE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322EBC0 mov eax, dword ptr fs:[00000030h]2_2_0322EBC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B4BC0 mov eax, dword ptr fs:[00000030h]2_2_032B4BC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B4BC0 mov eax, dword ptr fs:[00000030h]2_2_032B4BC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B4BC0 mov eax, dword ptr fs:[00000030h]2_2_032B4BC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B4BC0 mov eax, dword ptr fs:[00000030h]2_2_032B4BC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D6BDE mov ebx, dword ptr fs:[00000030h]2_2_032D6BDE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D6BDE mov eax, dword ptr fs:[00000030h]2_2_032D6BDE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03258BD1 mov eax, dword ptr fs:[00000030h]2_2_03258BD1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03258BD1 mov eax, dword ptr fs:[00000030h]2_2_03258BD1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326AA0E mov eax, dword ptr fs:[00000030h]2_2_0326AA0E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326AA0E mov eax, dword ptr fs:[00000030h]2_2_0326AA0E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325EA40 mov eax, dword ptr fs:[00000030h]2_2_0325EA40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325EA40 mov eax, dword ptr fs:[00000030h]2_2_0325EA40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032CAA40 mov eax, dword ptr fs:[00000030h]2_2_032CAA40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032CAA40 mov eax, dword ptr fs:[00000030h]2_2_032CAA40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B4A57 mov eax, dword ptr fs:[00000030h]2_2_032B4A57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B4A57 mov eax, dword ptr fs:[00000030h]2_2_032B4A57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E6A50 mov ecx, dword ptr fs:[00000030h]2_2_032E6A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E6A80 mov eax, dword ptr fs:[00000030h]2_2_032E6A80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D0AE0 mov eax, dword ptr fs:[00000030h]2_2_032D0AE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D2AE0 mov eax, dword ptr fs:[00000030h]2_2_032D2AE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D2AE0 mov eax, dword ptr fs:[00000030h]2_2_032D2AE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03250AEB mov eax, dword ptr fs:[00000030h]2_2_03250AEB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03250AEB mov eax, dword ptr fs:[00000030h]2_2_03250AEB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03250AEB mov eax, dword ptr fs:[00000030h]2_2_03250AEB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230AED mov eax, dword ptr fs:[00000030h]2_2_03230AED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230AED mov eax, dword ptr fs:[00000030h]2_2_03230AED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230AED mov eax, dword ptr fs:[00000030h]2_2_03230AED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B0AFF mov eax, dword ptr fs:[00000030h]2_2_032B0AFF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B0AFF mov eax, dword ptr fs:[00000030h]2_2_032B0AFF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B0AFF mov eax, dword ptr fs:[00000030h]2_2_032B0AFF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304AE8 mov eax, dword ptr fs:[00000030h]2_2_03304AE8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240ACE mov eax, dword ptr fs:[00000030h]2_2_03240ACE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240ACE mov eax, dword ptr fs:[00000030h]2_2_03240ACE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D4AC2 mov eax, dword ptr fs:[00000030h]2_2_032D4AC2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F892E mov eax, dword ptr fs:[00000030h]2_2_032F892E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F892E mov eax, dword ptr fs:[00000030h]2_2_032F892E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AC920 mov ecx, dword ptr fs:[00000030h]2_2_032AC920
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AC920 mov eax, dword ptr fs:[00000030h]2_2_032AC920
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AC920 mov eax, dword ptr fs:[00000030h]2_2_032AC920
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AC920 mov eax, dword ptr fs:[00000030h]2_2_032AC920
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0328693A mov eax, dword ptr fs:[00000030h]2_2_0328693A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0328693A mov eax, dword ptr fs:[00000030h]2_2_0328693A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0328693A mov eax, dword ptr fs:[00000030h]2_2_0328693A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0330492D mov eax, dword ptr fs:[00000030h]2_2_0330492D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03286912 mov eax, dword ptr fs:[00000030h]2_2_03286912
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03262919 mov eax, dword ptr fs:[00000030h]2_2_03262919
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03262919 mov eax, dword ptr fs:[00000030h]2_2_03262919
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324096B mov eax, dword ptr fs:[00000030h]2_2_0324096B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324096B mov eax, dword ptr fs:[00000030h]2_2_0324096B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236970 mov eax, dword ptr fs:[00000030h]2_2_03236970
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236970 mov eax, dword ptr fs:[00000030h]2_2_03236970
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236970 mov eax, dword ptr fs:[00000030h]2_2_03236970
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236970 mov eax, dword ptr fs:[00000030h]2_2_03236970
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236970 mov eax, dword ptr fs:[00000030h]2_2_03236970
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236970 mov eax, dword ptr fs:[00000030h]2_2_03236970
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236970 mov eax, dword ptr fs:[00000030h]2_2_03236970
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C944 mov eax, dword ptr fs:[00000030h]2_2_0326C944
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E94E mov eax, dword ptr fs:[00000030h]2_2_0325E94E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03254955 mov eax, dword ptr fs:[00000030h]2_2_03254955
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03254955 mov eax, dword ptr fs:[00000030h]2_2_03254955
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C958 mov eax, dword ptr fs:[00000030h]2_2_0326C958
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323E9A0 mov eax, dword ptr fs:[00000030h]2_2_0323E9A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323E9A0 mov eax, dword ptr fs:[00000030h]2_2_0323E9A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323E9A0 mov eax, dword ptr fs:[00000030h]2_2_0323E9A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323E9A0 mov eax, dword ptr fs:[00000030h]2_2_0323E9A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323E9A0 mov eax, dword ptr fs:[00000030h]2_2_0323E9A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323E9A0 mov eax, dword ptr fs:[00000030h]2_2_0323E9A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323E9A0 mov eax, dword ptr fs:[00000030h]2_2_0323E9A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323E9A0 mov eax, dword ptr fs:[00000030h]2_2_0323E9A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323E9A0 mov eax, dword ptr fs:[00000030h]2_2_0323E9A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B89A0 mov eax, dword ptr fs:[00000030h]2_2_032B89A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032689B0 mov edx, dword ptr fs:[00000030h]2_2_032689B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C69B0 mov eax, dword ptr fs:[00000030h]2_2_032C69B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C69B0 mov eax, dword ptr fs:[00000030h]2_2_032C69B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C69B0 mov ecx, dword ptr fs:[00000030h]2_2_032C69B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C98F mov eax, dword ptr fs:[00000030h]2_2_0326C98F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C98F mov eax, dword ptr fs:[00000030h]2_2_0326C98F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C98F mov eax, dword ptr fs:[00000030h]2_2_0326C98F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D0980 mov eax, dword ptr fs:[00000030h]2_2_032D0980
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D0980 mov eax, dword ptr fs:[00000030h]2_2_032D0980
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032309F0 mov eax, dword ptr fs:[00000030h]2_2_032309F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032649F0 mov eax, dword ptr fs:[00000030h]2_2_032649F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032649F0 mov eax, dword ptr fs:[00000030h]2_2_032649F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032389C0 mov eax, dword ptr fs:[00000030h]2_2_032389C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032389C0 mov eax, dword ptr fs:[00000030h]2_2_032389C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033029CF mov eax, dword ptr fs:[00000030h]2_2_033029CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033029CF mov eax, dword ptr fs:[00000030h]2_2_033029CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0835 mov eax, dword ptr fs:[00000030h]2_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0835 mov eax, dword ptr fs:[00000030h]2_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0835 mov eax, dword ptr fs:[00000030h]2_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0835 mov eax, dword ptr fs:[00000030h]2_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0835 mov eax, dword ptr fs:[00000030h]2_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0835 mov eax, dword ptr fs:[00000030h]2_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0835 mov eax, dword ptr fs:[00000030h]2_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0835 mov eax, dword ptr fs:[00000030h]2_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0835 mov eax, dword ptr fs:[00000030h]2_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0835 mov eax, dword ptr fs:[00000030h]2_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0835 mov eax, dword ptr fs:[00000030h]2_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0835 mov eax, dword ptr fs:[00000030h]2_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0835 mov eax, dword ptr fs:[00000030h]2_2_032E0835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C819 mov eax, dword ptr fs:[00000030h]2_2_0326C819
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C819 mov eax, dword ptr fs:[00000030h]2_2_0326C819
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BC870 mov eax, dword ptr fs:[00000030h]2_2_032BC870
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B488F mov eax, dword ptr fs:[00000030h]2_2_032B488F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03256882 mov eax, dword ptr fs:[00000030h]2_2_03256882
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03256882 mov eax, dword ptr fs:[00000030h]2_2_03256882
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03256882 mov eax, dword ptr fs:[00000030h]2_2_03256882
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327088E mov eax, dword ptr fs:[00000030h]2_2_0327088E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327088E mov edx, dword ptr fs:[00000030h]2_2_0327088E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327088E mov eax, dword ptr fs:[00000030h]2_2_0327088E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E8890 mov eax, dword ptr fs:[00000030h]2_2_032E8890
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E8890 mov eax, dword ptr fs:[00000030h]2_2_032E8890
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A8F0 mov eax, dword ptr fs:[00000030h]2_2_0323A8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A8F0 mov eax, dword ptr fs:[00000030h]2_2_0323A8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A8F0 mov eax, dword ptr fs:[00000030h]2_2_0323A8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A8F0 mov eax, dword ptr fs:[00000030h]2_2_0323A8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A8F0 mov eax, dword ptr fs:[00000030h]2_2_0323A8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A8F0 mov eax, dword ptr fs:[00000030h]2_2_0323A8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032648F0 mov eax, dword ptr fs:[00000030h]2_2_032648F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C88FB mov eax, dword ptr fs:[00000030h]2_2_032C88FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C0 mov eax, dword ptr fs:[00000030h]2_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C0 mov eax, dword ptr fs:[00000030h]2_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C0 mov eax, dword ptr fs:[00000030h]2_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C0 mov eax, dword ptr fs:[00000030h]2_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C0 mov eax, dword ptr fs:[00000030h]2_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C0 mov eax, dword ptr fs:[00000030h]2_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C0 mov eax, dword ptr fs:[00000030h]2_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C0 mov eax, dword ptr fs:[00000030h]2_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C0 mov eax, dword ptr fs:[00000030h]2_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C0 mov eax, dword ptr fs:[00000030h]2_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C0 mov eax, dword ptr fs:[00000030h]2_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C0 mov eax, dword ptr fs:[00000030h]2_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428C0 mov eax, dword ptr fs:[00000030h]2_2_032428C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032288C8 mov eax, dword ptr fs:[00000030h]2_2_032288C8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032288C8 mov eax, dword ptr fs:[00000030h]2_2_032288C8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032308CD mov eax, dword ptr fs:[00000030h]2_2_032308CD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032308CD mov eax, dword ptr fs:[00000030h]2_2_032308CD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B8F3C mov eax, dword ptr fs:[00000030h]2_2_032B8F3C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B8F3C mov eax, dword ptr fs:[00000030h]2_2_032B8F3C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B8F3C mov ecx, dword ptr fs:[00000030h]2_2_032B8F3C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B8F3C mov ecx, dword ptr fs:[00000030h]2_2_032B8F3C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324CF00 mov eax, dword ptr fs:[00000030h]2_2_0324CF00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324CF00 mov eax, dword ptr fs:[00000030h]2_2_0324CF00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304F1D mov eax, dword ptr fs:[00000030h]2_2_03304F1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03270F16 mov eax, dword ptr fs:[00000030h]2_2_03270F16
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03270F16 mov eax, dword ptr fs:[00000030h]2_2_03270F16
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03270F16 mov eax, dword ptr fs:[00000030h]2_2_03270F16
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03270F16 mov eax, dword ptr fs:[00000030h]2_2_03270F16
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EEF66 mov eax, dword ptr fs:[00000030h]2_2_032EEF66
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304F7C mov eax, dword ptr fs:[00000030h]2_2_03304F7C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325AF72 mov eax, dword ptr fs:[00000030h]2_2_0325AF72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03286F70 mov eax, dword ptr fs:[00000030h]2_2_03286F70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322EF79 mov eax, dword ptr fs:[00000030h]2_2_0322EF79
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322EF79 mov eax, dword ptr fs:[00000030h]2_2_0322EF79
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322EF79 mov eax, dword ptr fs:[00000030h]2_2_0322EF79
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D0F49 mov eax, dword ptr fs:[00000030h]2_2_032D0F49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D0F49 mov eax, dword ptr fs:[00000030h]2_2_032D0F49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D0F49 mov eax, dword ptr fs:[00000030h]2_2_032D0F49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EAF50 mov ecx, dword ptr fs:[00000030h]2_2_032EAF50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03234FB6 mov eax, dword ptr fs:[00000030h]2_2_03234FB6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325CFB0 mov eax, dword ptr fs:[00000030h]2_2_0325CFB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325CFB0 mov eax, dword ptr fs:[00000030h]2_2_0325CFB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03268FBC mov eax, dword ptr fs:[00000030h]2_2_03268FBC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B8F8B mov eax, dword ptr fs:[00000030h]2_2_032B8F8B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B8F8B mov eax, dword ptr fs:[00000030h]2_2_032B8F8B
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00426DA1 CreateFileW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,SetEndOfFile,GetLastError,0_2_00426DA1
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004230F5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00417D93 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeNtTerminateThread: Direct from: 0x7FF86B5C2651Jump to behavior
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeNtDelayExecution: Direct from: 0x74D56A1Jump to behavior
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeNtProtectVirtualMemory: Direct from: 0x74DD28FJump to behavior
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeNtResumeThread: Direct from: 0x74D5718Jump to behavior
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeNtDelayExecution: Direct from: 0x74D54D2Jump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\expand.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\expand.exeSection loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\expand.exeSection loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\expand.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\svchost.exeThread register set: target process: 5340Jump to behavior
            Source: C:\Windows\SysWOW64\expand.exeThread register set: target process: 5340Jump to behavior
            Queues an APC in another process (thread injection)
            Source: C:\Windows\SysWOW64\svchost.exeThread APC queued: target process: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeJump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\Purchase Order.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 4B0008Jump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00436431 mouse_event,mouse_event,0_2_00436431
            Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Purchase Order.exe"Jump to behavior
            Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeProcess created: C:\Windows\SysWOW64\expand.exe "C:\Windows\SysWOW64\expand.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
            Source: explorer.exe, 00000006.00000002.7526323118.0000000001163000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4810052462.0000000001163000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd.\
            Source: Purchase Order.exe, RAVCpl64.exe, 00000004.00000002.7527538058.0000000000E51000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000004.00000000.3269003788.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.7527230757.0000000001981000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: RAVCpl64.exe, 00000004.00000002.7527538058.0000000000E51000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000004.00000000.3269003788.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.7526323118.0000000001163000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progman
            Source: Purchase Order.exeBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
            Source: RAVCpl64.exe, 00000004.00000002.7527538058.0000000000E51000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000004.00000000.3269003788.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.7527230757.0000000001981000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: RAVCpl64.exe, 00000004.00000002.7527538058.0000000000E51000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000004.00000000.3269003788.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.7527230757.0000000001981000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager]
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0042039F GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,0_2_0042039F
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.600000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.600000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000005.00000002.4885525142.0000000004250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.4885598668.00000000042A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.3339599911.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.3338743779.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Purchase Order.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
            Source: Purchase Order.exeBinary or memory string: WIN_XP
            Source: Purchase Order.exeBinary or memory string: WIN_XPe
            Source: Purchase Order.exeBinary or memory string: WIN_VISTA
            Source: Purchase Order.exeBinary or memory string: WIN_7

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.600000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.600000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000005.00000002.4885525142.0000000004250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.4885598668.00000000042A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.3339599911.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.3338743779.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
            Source: C:\Users\user\Desktop\Purchase Order.exeCode function: 0_2_0047AD92 OleInitialize,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure2
            Valid Accounts            		1
            Native API            		1
            DLL Side-Loading            		1
            Exploitation for Privilege Escalation            		1
            Disable or Modify Tools            		21
            Input Capture            		2
            System Time Discovery            		Remote Services1
            Archive Collected Data            		1
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault AccountsScheduled Task/Job2
            Valid Accounts            		1
            Abuse Elevation Control Mechanism            		1
            Deobfuscate/Decode Files or Information            		LSASS Memory1
            Account Discovery            		Remote Desktop Protocol21
            Input Capture            		1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		Security Account Manager2
            File and Directory Discovery            		SMB/Windows Admin Shares3
            Clipboard Data            		SteganographyAutomated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
            Valid Accounts            		2
            Obfuscated Files or Information            		NTDS115
            System Information Discovery            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
            Access Token Manipulation            		1
            DLL Side-Loading            		LSA Secrets241
            Security Software Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
            Process Injection            		2
            Valid Accounts            		Cached Domain Credentials2
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
            Virtualization/Sandbox Evasion            		DCSync3
            Process Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
            Access Token Manipulation            		Proc Filesystem11
            Application Window Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
            Process Injection            		/etc/passwd and /etc/shadow1
            System Owner/User Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            Purchase Order.exe32%ReversingLabsWin32.Trojan.Generic
            Purchase Order.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            ⊘No Antivirus matches

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 00000006.00000000.4818523594.000000000D88C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7538704599.000000000D88C000.00000004.00000001.00020000.00000000.sdmpfalse
              		unknown
              https://www.msn.com/en-us/lifestyle/celeb-style/the-21-best-red-carpet-fashion-moments-of-all-time/sexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                		unknown
                https://ntp.mexplorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpfalse
                  		unknown
                  https://cdn.queexplorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmpfalse
                    		unknown
                    https://www.msn.com/en-us/news/politics/can-kamala-harris-beat-donald-trump-latest-poll-updates/ar-Aexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                      		unknown
                      https://ntp.msn.com/edge/ntp?cm=e&ociexplorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpfalse
                        		unknown
                        https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/D200PartlySunnyV2.svexplorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                          		unknown
                          https://www.delish.com/cooking/recipe-ideas/a40239263/philadelphia-roll-recipe/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                            		unknown
                            https://www.delish.com/cooking/nutrition/g2599/healthy-dinner-salads/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                              		unknown
                              https://www.delish.com/cooking/recipe-ideas/g32055698/how-to-make-leftovers-more-exciting/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                		unknown
                                https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4818523594.000000000D88C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7538704599.000000000D88C000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		unknown
                                  https://www.msn.com/en-us/feedexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://www.delish.com/cooking/recipe-ideas/g3219/copycat-recipes/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://www.delish.com/cooking/recipe-ideas/g1092/wrap-recipes/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRoU-darkexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://api.msn.com/;explorer.exe, 00000006.00000000.4811153831.00000000037A0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7528175498.00000000037A0000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		unknown
                                            https://www.delish.com/cooking/recipe-ideas/g3026/fall-soup-recipes/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		unknown
                                              https://www.delish.com/cooking/recipe-ideas/a26146740/ahi-poke-bowls/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://excel.office.comexplorer.exe, 00000006.00000002.7539498768.000000000D927000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819076069.000000000D927000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  http://schemas.microexplorer.exe, 00000006.00000002.7535770556.000000000AC50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.4810489818.00000000015C0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000002.7534939116.000000000A1D0000.00000002.00000001.00040000.00000000.sdmpfalse
                                                    		unknown
                                                    https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gAyL-darkexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gAyLexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        https://powerpoint.office.comEMexplorer.exe, 00000006.00000000.4818523594.000000000D88C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7538704599.000000000D88C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          https://aka.ms/odirmexplorer.exe, 00000006.00000002.7532968534.0000000009CA7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4814522688.0000000009CA7000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            https://www.delish.com/cooking/a36622721/everything-bagel-seasoning/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              https://www.msn.com/en-us/news/technology/microsoft-reveals-windows-11-s-ai-roadmap-smart-search-upsexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                https://www.delish.com/cooking/recipe-ideas/recipes/a46821/general-tsos-chicken-stir-fry-recipe/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  https://outlook.comP51explorer.exe, 00000006.00000002.7539498768.000000000D927000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819076069.000000000D927000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    https://www.delish.com/cooking/g39601341/breakfast-meal-prep-ideas/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://www.delish.com/cooking/recipe-ideas/a22096112/copycat-chipotle-chicken-recipe/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://www.delish.com/cooking/recipe-ideas/g2887/138-no-bake-desserts/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          https://www.delish.com/cooking/recipe-ideas/recipes/a54961/chicken-caesar-wraps-recipe/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gFtr-darkexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              https://windows.msn.com:443/shell?osLocale=en-US&chosenMarketReason=ImplicitNewexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                https://www.delish.com/cooking/recipe-ideas/recipes/a49533/asian-lettuce-wraps-recipe/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  https://www.msn.com/en-us/money/companies/charles-schwab-names-president-rick-wurster-as-next-ceo/arexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://www.delish.com/cooking/recipe-ideas/g3338/best-weeknight-dinners/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://assets.msn.cexplorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        https://universalstore.streaming.mediaservices.windows.net/75db58d3-3007-4c4c-b2fc-8f6f86633a31/5abaexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          https://www.msn.com/en-us/sports/nfl/miami-dolphins-mike-mcdaniel-draws-line-knows-things-must-changexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            https://www.msn.com/en-us/news/world/prince-william-joins-david-beckham-in-the-cockpit-for-helicopteexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              https://www.msn.com/en-us/tv/news/frank-fritz-american-pickers-co-host-dies-at-60/ar-AA1rxfcmexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://windows.msn.com:443/shellv2?osLocale=en-US&chosenMarketReason=ImplicitNewexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://www.msn.com/en-us/money/realestate/ask-the-builder-asphalt-shingle-alternatives/ar-AA1rjlszexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://word.office.comexplorer.exe, 00000006.00000002.7539498768.000000000D927000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819076069.000000000D927000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRoUexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        https://www.msn.com/en-us/news/world/russia-secures-biggest-victory-since-february-as-it-captures-ukexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          https://www.msn.com/en-us/sports/other/ohio-state-women-s-basketball-freshman-ava-watson-s-ability-texplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            https://www.msn.com/en-us/lifestyle/lifestyle-buzz/tracee-ellis-ross-wedge-ponytail-is-a-new-way-to-explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              https://www.msn.com/en-us/lifestyle/pets/these-are-the-largest-reptiles-still-living-in-the-u-s/ss-Bexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                https://www.msn.com/en-us/tv/news/arsenio-hall-net-worth-a-closer-look-at-the-comedian-s-wealth/ar-Aexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  https://api.msn.com/v1/news/Feed/Windows?activityId=74FEDC5505D64D82A7BF425565317295&timeOut=5000&ocexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    https://ntp.msn.com/edge/ntp?cm=en-us&ocid=widgetonlockscreenwin10&cvid=03f221f1-efc8-4ebc-bcdc-9c6bexplorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://www.msn.com/en-us/channel/source/AZ%20Animals%20US/sr-vid-7etr9q8xunexplorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        https://www.delish.com/cooking/recipe-ideas/a27793321/chimichurri-sauce-recipe/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          https://www.msn.com/en-us/money/companies/pepsico-to-buy-tortilla-chip-maker-siete-foods-for-1-2-bilexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            https://www.msn.com/en-us/news/politics/n-c-presidential-race-close-as-helene-recovery-begins-post-pexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/D200PartlySunnyV2.pnexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                https://ntp.msn.com/edge/ntp?cm=eexplorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://assets.msn.ceathexplorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    https://www.delish.com/cooking/recipe-ideas/a40022315/steak-grain-bowls-recipe/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      https://assets.msn.com/weathermapdata/1/static/finance/taskbar/icons/index/svg/light/greenup.svgexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://outlook.compexplorer.exe, 00000006.00000002.7539498768.000000000D927000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819076069.000000000D927000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://www.msn.com/en-us/foodanddrink/recipes/i-asked-3-butchers-how-to-choose-the-best-steak-they-explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gFtrexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              https://www.delish.com/cooking/recipe-ideas/a52078/crunchwrap-supreme-recipe/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                https://www.msn.com/en-us/movies/news/robert-downey-jr-beams-as-he-makes-his-broadway-bow-on-openingexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  https://api.msn.com/explorer.exe, 00000006.00000000.4811153831.00000000037A0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7528175498.00000000037A0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    https://api.msn.com/v1/news/Feed/Windows?activityId=DC09251A71C5472DA2BDFD73DC109609&timeOut=5000&ocexplorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      https://www.delish.com/cooking/g1590/easy-lunch-sandwiches/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://www.delish.com/cooking/recipe-ideas/recipes/a45873/copycat-olive-garden-zuppa-toscana-recipeexplorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://www.delish.com/cooking/recipe-ideas/a40837113/caribbean-cobb-salad-recipe/explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://www.msn.com/en-us/foodanddrink/cookingschool/for-the-best-grilled-clams-avoid-this-fatal-misexplorer.exe, 00000006.00000002.7531970828.0000000009AA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4813810894.0000000009AA2000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              https://ntp.mdge/ntp?explorer.exe, 00000006.00000000.4813771435.0000000009A90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.7531907911.0000000009A90000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                https://assets.msn.com/weathermapdata/1/static/finance/taskbar/icons/index/svg/light/reddown.svgexplorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://www.delish.com/cooking/recipe-ideas/g3034/quick-work-lunch-ideas/explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://www.msn.com/en-us/money/companies/microsoft-exec-tells-staff-there-won-t-be-an-amazon-style-explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://www.msn.com/en-us/news/world/a-former-hostage-fought-for-her-own-life-in-gaza-a-year-on-she-explorer.exe, 00000006.00000002.7540381501.000000000DC32000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.4819755786.000000000DC32000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown

                                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                                        ⊘No contacted IP infos

                                                                                                                                                                        General Information

                                                                                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                        Analysis ID:1523569
                                                                                                                                                                        Start date and time:2024-10-01 19:43:34 +02:00
                                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                                        Overall analysis duration:0h 16m 18s
                                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                                        Report type:full
                                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                                        Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                                                                                                                                                        Run name:Suspected Instruction Hammering
                                                                                                                                                                        Number of analysed new started processes analysed:5
                                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                                        Number of injected processes analysed:2
                                                                                                                                                                        Technologies:
                                                                                                                                                                        • HCA enabled
                                                                                                                                                                        • EGA enabled
                                                                                                                                                                        • AMSI enabled
                                                                                                                                                                        Analysis Mode:default
                                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                                        Sample name:Purchase Order.exe
                                                                                                                                                                        Detection:MAL
                                                                                                                                                                        Classification:mal100.troj.evad.winEXE@5/1@0/0
                                                                                                                                                                        EGA Information:
                                                                                                                                                                        • Successful, ratio: 66.7%
                                                                                                                                                                        HCA Information:
                                                                                                                                                                        • Successful, ratio: 96%
                                                                                                                                                                        • Number of executed functions: 37
                                                                                                                                                                        • Number of non-executed functions: 296
                                                                                                                                                                        Cookbook Comments:
                                                                                                                                                                        • Found application associated with file extension: .exe
                                                                                                                                                                        • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                                                                                                        Warnings

                                                                                                                                                                        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
                                                                                                                                                                        • Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
                                                                                                                                                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                        • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                        • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                        • VT rate limit hit for: Purchase Order.exe

                                                                                                                                                                        Simulations

                                                                                                                                                                        Behavior and APIs

                                                                                                                                                                        TimeTypeDescription
                                                                                                                                                                        13:47:45API Interceptor11246973x Sleep call for process: expand.exe modified

                                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                                        IPs

                                                                                                                                                                        ⊘No context

                                                                                                                                                                        Domains

                                                                                                                                                                        ⊘No context

                                                                                                                                                                        ASNs

                                                                                                                                                                        ⊘No context

                                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                                        ⊘No context

                                                                                                                                                                        Dropped Files

                                                                                                                                                                        ⊘No context

                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Hymenophyllaceae

                                                                                                                                                                        Download File
                                                                                                                                                                        Process:C:\Users\user\Desktop\Purchase Order.exe
                                                                                                                                                                        File Type:data
                                                                                                                                                                        Category:dropped
                                                                                                                                                                        Size (bytes):287744
                                                                                                                                                                        Entropy (8bit):7.990614133804907
                                                                                                                                                                        Encrypted:true
                                                                                                                                                                        SSDEEP:6144:33WQ5F2K1LI2vt9BRGn8XT5Sm7vwOWsBAi56R3P/lO:33WQ2k/VpDXYgwOVsR//lO
                                                                                                                                                                        MD5:B275DFBD54A2640A383D971297B51568
                                                                                                                                                                        SHA1:BBDE38C6661EC411CE234DADD5290BE3811437DC
                                                                                                                                                                        SHA-256:30DF910AA3A4F2F3B0E1A979D55465F5F67D7B4F1D70F6E961AB708A91C9C733
                                                                                                                                                                        SHA-512:C2EB5324F74C437EFEE4B9652402FA11D3921C7FEA4F2BFF24CAA0BBDA38A2C9D58EDFB002DE66DCE0AE646F3FE3467BD5A45F35EC07ADFA65FC7A24F920CFBA
                                                                                                                                                                        Malicious:false
                                                                                                                                                                        Reputation:low
                                                                                                                                                                        Preview:.....THPO...^..u.HS...TX...ITHPOHQ1WPDHYITHPOHQ1WPDHYITHP.HQ1YO.FY.].q.I..v.,!*i$:?(:0\w3%&7& h2*h#D9p-&y...p"'5Ty]IB}ITHPOHQHVY.u9..u0(.lQ0.^..n(7.R...l$/.S..s(6..9' d)3.POHQ1WPD..IT.QNHsS@.DHYITHPO.Q3V[ECYI.LPOHQ1WPDHY]THP_HQ1'TDHY.TH@OHQ3WPBHYITHPONQ1WPDHYI$LPOJQ1WPDH[I..POXQ1GPDHYYTH@OHQ1WPTHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHw=10$OHQ..TDHIITH.KHQ!WPDHYITHPOHQ1WpDH9ITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1WPDHYITHPOHQ1

                                                                                                                                                                        Static File Info

                                                                                                                                                                        General

                                                                                                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                        Entropy (8bit):7.519958097559221
                                                                                                                                                                        TrID:
                                                                                                                                                                        • Win32 Executable (generic) a (10002005/4) 95.11%
                                                                                                                                                                        • AutoIt3 compiled script executable (510682/80) 4.86%
                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                        File name:Purchase Order.exe
                                                                                                                                                                        File size:1'341'549 bytes
                                                                                                                                                                        MD5:4bf3c3730f87303d462d33cd7439d24e
                                                                                                                                                                        SHA1:0b242ca2f09aca59d55bfcac3c6842d3b5ed2578
                                                                                                                                                                        SHA256:3ef886ad71e5fc825b9b608b3f80ce2a3c3dafc0ecc1bc7dc9721c6855898bc6
                                                                                                                                                                        SHA512:2e6a92fed0ef35dc8a52a764baebbd2dbcd3920e8107b7381e00ef95185e668a0803fb891d3053509f7f867efba0e37738b19bc755df83bc9d9943768bea482a
                                                                                                                                                                        SSDEEP:24576:ffmMv6Ckr7Mny5QLYVaCcMTEq686HA5KILVmPHt:f3v+7/5QLYRcwr6lH7IgPN
                                                                                                                                                                        TLSH:AE55F112B7D680B6EDA33971193BE32AEB3575194337C4CBA7E02E779E111405B3A362
                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

                                                                                                                                                                        File Icon

                                                                                                                                                                        Icon Hash:1733312925935517

                                                                                                                                                                        Static PE Info

                                                                                                                                                                        General

                                                                                                                                                                        Entrypoint:0x416310
                                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                                        Digitally signed:false
                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                                                                                                        DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                                                                                                        Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                        OS Version Major:5
                                                                                                                                                                        OS Version Minor:0
                                                                                                                                                                        File Version Major:5
                                                                                                                                                                        File Version Minor:0
                                                                                                                                                                        Subsystem Version Major:5
                                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                                        Import Hash:aaaa8913c89c8aa4a5d93f06853894da

                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                        Instruction
                                                                                                                                                                        call 00007F5EE4585F6Ch
                                                                                                                                                                        jmp 00007F5EE4579D3Eh
                                                                                                                                                                        int3
                                                                                                                                                                        int3
                                                                                                                                                                        int3
                                                                                                                                                                        int3
                                                                                                                                                                        int3
                                                                                                                                                                        int3
                                                                                                                                                                        push ebp
                                                                                                                                                                        mov ebp, esp
                                                                                                                                                                        push edi
                                                                                                                                                                        push esi
                                                                                                                                                                        mov esi, dword ptr [ebp+0Ch]
                                                                                                                                                                        mov ecx, dword ptr [ebp+10h]
                                                                                                                                                                        mov edi, dword ptr [ebp+08h]
                                                                                                                                                                        mov eax, ecx
                                                                                                                                                                        mov edx, ecx
                                                                                                                                                                        add eax, esi
                                                                                                                                                                        cmp edi, esi
                                                                                                                                                                        jbe 00007F5EE4579ECAh
                                                                                                                                                                        cmp edi, eax
                                                                                                                                                                        jc 00007F5EE457A06Ah
                                                                                                                                                                        cmp ecx, 00000100h
                                                                                                                                                                        jc 00007F5EE4579EE1h
                                                                                                                                                                        cmp dword ptr [004A94E0h], 00000000h
                                                                                                                                                                        je 00007F5EE4579ED8h
                                                                                                                                                                        push edi
                                                                                                                                                                        push esi
                                                                                                                                                                        and edi, 0Fh
                                                                                                                                                                        and esi, 0Fh
                                                                                                                                                                        cmp edi, esi
                                                                                                                                                                        pop esi
                                                                                                                                                                        pop edi
                                                                                                                                                                        jne 00007F5EE4579ECAh
                                                                                                                                                                        pop esi
                                                                                                                                                                        pop edi
                                                                                                                                                                        pop ebp
                                                                                                                                                                        jmp 00007F5EE457A32Ah
                                                                                                                                                                        test edi, 00000003h
                                                                                                                                                                        jne 00007F5EE4579ED7h
                                                                                                                                                                        shr ecx, 02h
                                                                                                                                                                        and edx, 03h
                                                                                                                                                                        cmp ecx, 08h
                                                                                                                                                                        jc 00007F5EE4579EECh
                                                                                                                                                                        rep movsd
                                                                                                                                                                        jmp dword ptr [00416494h+edx*4]
                                                                                                                                                                        nop
                                                                                                                                                                        mov eax, edi
                                                                                                                                                                        mov edx, 00000003h
                                                                                                                                                                        sub ecx, 04h
                                                                                                                                                                        jc 00007F5EE4579ECEh
                                                                                                                                                                        and eax, 03h
                                                                                                                                                                        add ecx, eax
                                                                                                                                                                        jmp dword ptr [004163A8h+eax*4]
                                                                                                                                                                        jmp dword ptr [004164A4h+ecx*4]
                                                                                                                                                                        nop
                                                                                                                                                                        jmp dword ptr [00416428h+ecx*4]
                                                                                                                                                                        nop
                                                                                                                                                                        mov eax, E4004163h
                                                                                                                                                                        arpl word ptr [ecx+00h], ax
                                                                                                                                                                        or byte ptr [ecx+eax*2+00h], ah
                                                                                                                                                                        and edx, ecx
                                                                                                                                                                        mov al, byte ptr [esi]
                                                                                                                                                                        mov byte ptr [edi], al
                                                                                                                                                                        mov al, byte ptr [esi+01h]
                                                                                                                                                                        mov byte ptr [edi+01h], al
                                                                                                                                                                        mov al, byte ptr [esi+02h]
                                                                                                                                                                        shr ecx, 02h
                                                                                                                                                                        mov byte ptr [edi+02h], al
                                                                                                                                                                        add esi, 03h
                                                                                                                                                                        add edi, 03h
                                                                                                                                                                        cmp ecx, 08h
                                                                                                                                                                        jc 00007F5EE4579E8Eh

                                                                                                                                                                        Rich Headers

                                                                                                                                                                        Programming Language:
                                                                                                                                                                        • [ASM] VS2008 SP1 build 30729
                                                                                                                                                                        • [ C ] VS2008 SP1 build 30729
                                                                                                                                                                        • [C++] VS2008 SP1 build 30729
                                                                                                                                                                        • [ C ] VS2005 build 50727
                                                                                                                                                                        • [IMP] VS2005 build 50727
                                                                                                                                                                        • [ASM] VS2008 build 21022
                                                                                                                                                                        • [RES] VS2008 build 21022
                                                                                                                                                                        • [LNK] VS2008 SP1 build 30729

                                                                                                                                                                        Data Directories

                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x8cd3c0x154.rdata
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9298.rsrc
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x820000x840.rdata
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                        Sections

                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                        .text0x10000x800170x802006c20c6bf686768b6f134f5bd508171bcFalse0.5602991615853659data6.634688230255595IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                        .rdata0x820000xd95c0xda00f979966509a93083729d23cdfd2a6f2dFalse0.36256450688073394data4.880040824124099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                        .data0x900000x1a5180x6800e5d77411f751d28c6eee48a743606795False0.1600060096153846data2.2017649896261107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                        .rsrc0xab0000x92980x9400f6be76de0ef2c68f397158bf01bdef3eFalse0.4896801097972973data5.530303089784181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                        Resources

                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                        RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                                                                                                        RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                                                                                                        RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                                                                                                        RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                                                                                                                                                                        RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                                                                                                                                                                        RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                                                                                                                                                                        RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                                                                                                                                                                        RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                                                                                                                                                                        RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                                                                                                                                                                        RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                                                                                                                                                                        RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                                                                                                                                                                        RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                                                                                                                                                                        RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
                                                                                                                                                                        RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
                                                                                                                                                                        RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
                                                                                                                                                                        RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
                                                                                                                                                                        RT_STRING0xb28380x43adataEnglishGreat Britain0.3733826247689464
                                                                                                                                                                        RT_STRING0xb2c780x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                                                                                                        RT_STRING0xb32780x65cdataEnglishGreat Britain0.34336609336609336
                                                                                                                                                                        RT_STRING0xb38d80x388dataEnglishGreat Britain0.377212389380531
                                                                                                                                                                        RT_STRING0xb3c600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
                                                                                                                                                                        RT_GROUP_ICON0xb3db80x84dataEnglishGreat Britain0.6439393939393939
                                                                                                                                                                        RT_GROUP_ICON0xb3e400x14dataEnglishGreat Britain1.15
                                                                                                                                                                        RT_GROUP_ICON0xb3e580x14dataEnglishGreat Britain1.25
                                                                                                                                                                        RT_GROUP_ICON0xb3e700x14dataEnglishGreat Britain1.25
                                                                                                                                                                        RT_VERSION0xb3e880x19cdataEnglishGreat Britain0.5339805825242718
                                                                                                                                                                        RT_MANIFEST0xb40280x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581

                                                                                                                                                                        Imports

                                                                                                                                                                        DLLImport
                                                                                                                                                                        WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
                                                                                                                                                                        VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
                                                                                                                                                                        WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                                                                                                        COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
                                                                                                                                                                        MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
                                                                                                                                                                        WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
                                                                                                                                                                        PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
                                                                                                                                                                        USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
                                                                                                                                                                        KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
                                                                                                                                                                        USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
                                                                                                                                                                        GDI32.dllDeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
                                                                                                                                                                        COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                                                                                                        ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
                                                                                                                                                                        SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                                                                                                                        ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
                                                                                                                                                                        OLEAUT32.dllSafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

                                                                                                                                                                        Possible Origin

                                                                                                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                        EnglishGreat Britain
                                                                                                                                                                        EnglishUnited States

                                                                                                                                                                        Network Behavior

                                                                                                                                                                        ⊘No network behavior found

                                                                                                                                                                        Statistics

                                                                                                                                                                        CPU Usage

                                                                                                                                                                        Click to jump to process

                                                                                                                                                                        Memory Usage

                                                                                                                                                                        Click to jump to process

                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                        Behavior

                                                                                                                                                                        Click to jump to process

                                                                                                                                                                        System Behavior

                                                                                                                                                                        General

                                                                                                                                                                        Target ID:0
                                                                                                                                                                        Start time:13:45:40
                                                                                                                                                                        Start date:01/10/2024
                                                                                                                                                                        Path:C:\Users\user\Desktop\Purchase Order.exe
                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\Purchase Order.exe"
                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                        File size:1'341'549 bytes
                                                                                                                                                                        MD5 hash:4BF3C3730F87303D462D33CD7439D24E
                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                        Reputation:low
                                                                                                                                                                        Has exited:true

                                                                                                                                                                        General

                                                                                                                                                                        Target ID:2
                                                                                                                                                                        Start time:13:45:43
                                                                                                                                                                        Start date:01/10/2024
                                                                                                                                                                        Path:C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\Purchase Order.exe"
                                                                                                                                                                        Imagebase:0x800000
                                                                                                                                                                        File size:47'016 bytes
                                                                                                                                                                        MD5 hash:B7C999040D80E5BF87886D70D992C51E
                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                        Yara matches:
                                                                                                                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.3339599911.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.3339599911.0000000002F40000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.3338743779.0000000000600000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.3338743779.0000000000600000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                        Reputation:moderate
                                                                                                                                                                        Has exited:true

                                                                                                                                                                        General

                                                                                                                                                                        Target ID:4
                                                                                                                                                                        Start time:13:47:03
                                                                                                                                                                        Start date:01/10/2024
                                                                                                                                                                        Path:C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                        Commandline:"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
                                                                                                                                                                        Imagebase:0x140000000
                                                                                                                                                                        File size:16'696'840 bytes
                                                                                                                                                                        MD5 hash:731FB4B2E5AFBCADAABB80D642E056AC
                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                        Reputation:moderate
                                                                                                                                                                        Has exited:false

                                                                                                                                                                        General

                                                                                                                                                                        Target ID:5
                                                                                                                                                                        Start time:13:47:03
                                                                                                                                                                        Start date:01/10/2024
                                                                                                                                                                        Path:C:\Windows\SysWOW64\expand.exe
                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                        Commandline:"C:\Windows\SysWOW64\expand.exe"
                                                                                                                                                                        Imagebase:0xd20000
                                                                                                                                                                        File size:53'248 bytes
                                                                                                                                                                        MD5 hash:544B0DBFF3F393BCE8BB9D815F532D51
                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                        Yara matches:
                                                                                                                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4885525142.0000000004250000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.4885525142.0000000004250000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4885598668.00000000042A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.4885598668.00000000042A0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                        Reputation:moderate
                                                                                                                                                                        Has exited:true

                                                                                                                                                                        General

                                                                                                                                                                        Target ID:6
                                                                                                                                                                        Start time:13:49:37
                                                                                                                                                                        Start date:01/10/2024
                                                                                                                                                                        Path:C:\Windows\explorer.exe
                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                        Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                        Imagebase:0x7ff619960000
                                                                                                                                                                        File size:4'849'904 bytes
                                                                                                                                                                        MD5 hash:5EA66FF5AE5612F921BC9DA23BAC95F7
                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                        Reputation:high
                                                                                                                                                                        Has exited:false

                                                                                                                                                                        Disassembly

                                                                                                                                                                        Reset < >

                                                                                                                                                                          Execution Graph

                                                                                                                                                                          Execution Coverage:3%
                                                                                                                                                                          Dynamic/Decrypted Code Coverage:2.3%
                                                                                                                                                                          Signature Coverage:3.4%
                                                                                                                                                                          Total number of Nodes:1610
                                                                                                                                                                          Total number of Limit Nodes:43
                                                                                                                                                                          execution_graph 84739 4444e4 84744 40d900 84739->84744 84741 4444ee 84748 43723d 84741->84748 84743 444504 84745 40d917 84744->84745 84746 40d909 84744->84746 84745->84746 84747 40d91c CloseHandle 84745->84747 84746->84741 84747->84741 84749 40d900 CloseHandle 84748->84749 84750 437247 84749->84750 84750->84743 84751 4564a53 84752 4564a5a 84751->84752 84753 4564a62 84752->84753 84754 4564af8 84752->84754 84758 4564708 84753->84758 84771 45653a8 9 API calls 84754->84771 84757 4564adf 84772 45620f8 84758->84772 84760 45647a7 84763 4564801 VirtualAlloc 84760->84763 84768 45647e5 84760->84768 84769 4564908 CloseHandle 84760->84769 84770 4564918 VirtualFree 84760->84770 84775 4565618 GetPEB 84760->84775 84762 45647d8 CreateFileW 84762->84760 84762->84768 84764 4564822 ReadFile 84763->84764 84763->84768 84765 4564840 VirtualAlloc 84764->84765 84764->84768 84765->84760 84765->84768 84766 45649f4 VirtualFree 84767 4564a02 84766->84767 84767->84757 84768->84766 84768->84767 84769->84760 84770->84760 84771->84757 84774 4562783 84772->84774 84777 45655b8 GetPEB 84772->84777 84774->84760 84776 4565642 84775->84776 84776->84762 84777->84774 84778 444343 84781 444326 84778->84781 84780 44434e WriteFile 84782 444340 84781->84782 84783 4442c7 84781->84783 84782->84780 84788 40e190 SetFilePointerEx 84783->84788 84785 4442e0 SetFilePointerEx 84789 40e190 SetFilePointerEx 84785->84789 84787 4442ff 84787->84780 84788->84785 84789->84787 84790 46d22f 84793 46d098 84790->84793 84792 46d241 84794 46d0b5 84793->84794 84795 46d115 84794->84795 84796 46d0b9 84794->84796 84860 45c216 77 API calls 84795->84860 84837 41171a 84796->84837 84800 46d126 84802 46d0f8 84800->84802 84808 46d142 84800->84808 84801 46d0cc 84850 453063 84801->84850 84856 4092c0 84802->84856 84805 46d0fd 84805->84792 84809 46d1c8 84808->84809 84812 46d158 84808->84812 84866 4676a3 77 API calls 84809->84866 84815 453063 110 API calls 84812->84815 84813 46d0ea 84813->84808 84816 46d0ee 84813->84816 84814 46d1ce 84867 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 84814->84867 84822 46d15e 84815->84822 84816->84802 84855 44ade5 CloseHandle 84816->84855 84817 46d18d 84861 467fce 81 API calls 84817->84861 84821 46d196 84862 4013a0 74 API calls 84821->84862 84822->84817 84822->84821 84823 46d1e7 84826 4092c0 VariantClear 84823->84826 84835 46d194 84823->84835 84825 46d1a2 84863 40df50 74 API calls 84825->84863 84826->84835 84828 46d1ac 84864 40d3b0 74 API calls 84828->84864 84829 46d224 84829->84792 84831 40d900 CloseHandle 84833 46d216 84831->84833 84832 46d1b8 84865 467fce 81 API calls 84832->84865 84868 44ade5 CloseHandle 84833->84868 84835->84829 84835->84831 84839 411724 84837->84839 84840 41173e 84839->84840 84844 411740 84839->84844 84869 4138ba 84839->84869 84887 411afc 6 API calls 84839->84887 84840->84801 84849 40d940 75 API calls 84840->84849 84842 411766 84891 4116fd 66 API calls 84842->84891 84844->84842 84888 411421 84844->84888 84845 411770 84892 41805b RaiseException 84845->84892 84848 41177e 84849->84801 84851 45306e 84850->84851 84852 45307a 84850->84852 84851->84852 85030 452e2a 110 API calls 84851->85030 84854 40dfa0 82 API calls 84852->84854 84854->84813 84855->84802 84858 4092c8 84856->84858 84857 4092d5 84857->84805 84858->84857 84859 429db0 VariantClear 84858->84859 84859->84857 84860->84800 84861->84835 84862->84825 84863->84828 84864->84832 84865->84835 84866->84814 84867->84823 84868->84829 84870 41396d 84869->84870 84880 4138cc 84869->84880 84900 411afc 6 API calls 84870->84900 84872 413973 84901 417f23 66 API calls 84872->84901 84877 413929 RtlAllocateHeap 84877->84880 84878 4138dd 84878->84880 84893 418252 66 API calls 84878->84893 84894 4180a7 66 API calls 84878->84894 84895 411803 GetModuleHandleW GetProcAddress ExitProcess 84878->84895 84880->84877 84880->84878 84881 413959 84880->84881 84884 41395e 84880->84884 84886 413965 84880->84886 84896 41386b 66 API calls 84880->84896 84897 411afc 6 API calls 84880->84897 84898 417f23 66 API calls 84881->84898 84899 417f23 66 API calls 84884->84899 84886->84839 84887->84839 84902 4113e5 84888->84902 84890 41142e 84890->84842 84891->84845 84892->84848 84893->84878 84894->84878 84896->84880 84897->84880 84898->84884 84899->84886 84900->84872 84901->84886 84903 4113f1 84902->84903 84910 41181b 84903->84910 84909 411412 84909->84890 84936 418407 84910->84936 84912 4113f6 84913 4112fa 84912->84913 85001 4169e9 TlsGetValue 84913->85001 84916 4169e9 6 API calls 84917 41131e 84916->84917 84928 4113a1 84917->84928 85011 4170e7 67 API calls 84917->85011 84919 41696e 6 API calls 84921 411396 84919->84921 84920 41133c 84922 411357 84920->84922 84923 411366 84920->84923 84932 411388 84920->84932 84925 41696e 6 API calls 84921->84925 85012 417047 72 API calls 84922->85012 84924 411360 84923->84924 84923->84928 84924->84923 84929 41137c 84924->84929 85013 417047 72 API calls 84924->85013 84925->84928 84933 41141b 84928->84933 85014 41696e TlsGetValue 84929->85014 84930 411376 84930->84928 84930->84929 84932->84919 85026 411824 84933->85026 84937 41841c 84936->84937 84938 41842f EnterCriticalSection 84936->84938 84943 418344 84937->84943 84938->84912 84940 418422 84940->84938 84971 4117af 66 API calls 84940->84971 84942 41842e 84942->84938 84944 418350 84943->84944 84945 418360 84944->84945 84946 418378 84944->84946 84972 418252 66 API calls 84945->84972 84954 418386 84946->84954 84975 416fb6 84946->84975 84948 418365 84973 4180a7 66 API calls 84948->84973 84952 4183a7 84957 418407 66 API calls 84952->84957 84953 418398 84981 417f23 66 API calls 84953->84981 84954->84940 84955 41836c 84974 411803 GetModuleHandleW GetProcAddress ExitProcess 84955->84974 84959 4183ae 84957->84959 84961 4183e2 84959->84961 84962 4183b6 84959->84962 84963 413a88 66 API calls 84961->84963 84982 4189e6 InitializeCriticalSectionAndSpinCount 84962->84982 84965 4183d3 84963->84965 84997 4183fe LeaveCriticalSection 84965->84997 84966 4183c1 84966->84965 84983 413a88 84966->84983 84969 4183cd 84996 417f23 66 API calls 84969->84996 84971->84942 84972->84948 84973->84955 84978 416fbf 84975->84978 84976 4138ba 65 API calls 84976->84978 84977 416ff5 84977->84952 84977->84953 84978->84976 84978->84977 84979 416fd6 Sleep 84978->84979 84980 416feb 84979->84980 84980->84977 84980->84978 84981->84954 84982->84966 84984 413a94 84983->84984 84985 413ad3 84984->84985 84986 413b0d 84984->84986 84987 418407 64 API calls 84984->84987 84985->84986 84988 413ae8 RtlFreeHeap 84985->84988 84986->84969 84991 413aab 84987->84991 84988->84986 84989 413afa 84988->84989 85000 417f23 66 API calls 84989->85000 84993 413ac5 84991->84993 84998 419f9d VirtualFree VirtualFree HeapFree 84991->84998 84992 413aff GetLastError 84992->84986 84999 413ade LeaveCriticalSection 84993->84999 84996->84965 84997->84954 84998->84993 84999->84985 85000->84992 85002 416a01 85001->85002 85003 416a22 GetModuleHandleW 85001->85003 85002->85003 85004 416a0b TlsGetValue 85002->85004 85005 416a32 85003->85005 85006 416a3d GetProcAddress 85003->85006 85008 416a16 85004->85008 85024 41177f Sleep GetModuleHandleW 85005->85024 85010 41130e 85006->85010 85008->85003 85008->85010 85009 416a38 85009->85006 85009->85010 85010->84916 85011->84920 85012->84924 85013->84930 85015 4169a7 GetModuleHandleW 85014->85015 85016 416986 85014->85016 85018 4169c2 GetProcAddress 85015->85018 85019 4169b7 85015->85019 85016->85015 85017 416990 TlsGetValue 85016->85017 85022 41699b 85017->85022 85021 41699f 85018->85021 85025 41177f Sleep GetModuleHandleW 85019->85025 85021->84932 85022->85015 85022->85021 85023 4169bd 85023->85018 85023->85021 85024->85009 85025->85023 85029 41832d LeaveCriticalSection 85026->85029 85028 411420 85028->84909 85029->85028 85030->84852 85031 40116e 85032 401119 DefWindowProcW 85031->85032 85033 40f110 RegOpenKeyExW 85034 40f13c RegQueryValueExW RegCloseKey 85033->85034 85035 40f15f 85033->85035 85034->85035 85036 429212 85041 410b90 85036->85041 85039 411421 73 API calls 85040 42922f 85039->85040 85042 410b9a 85041->85042 85043 41171a 74 API calls 85042->85043 85044 410c31 GetModuleFileNameW 85043->85044 85058 413db0 85044->85058 85046 410c66 85061 413e3c 85046->85061 85049 41171a 74 API calls 85050 410ca3 85049->85050 85051 410cd1 RegOpenKeyExW 85050->85051 85052 429bc3 RegQueryValueExW 85051->85052 85053 410cf7 85051->85053 85054 429cd9 RegCloseKey 85052->85054 85056 429bf2 85052->85056 85053->85039 85055 41171a 74 API calls 85055->85056 85056->85055 85057 429cd8 85056->85057 85057->85054 85064 413b95 85058->85064 85094 41abec 85061->85094 85065 413c2f 85064->85065 85072 413bae 85064->85072 85066 413d60 85065->85066 85067 413d7b 85065->85067 85090 417f23 66 API calls 85066->85090 85092 417f23 66 API calls 85067->85092 85070 413d65 85075 413cfb 85070->85075 85091 417ebb 6 API calls 85070->85091 85072->85065 85080 413c1d 85072->85080 85086 41ab19 66 API calls 85072->85086 85074 413d03 85074->85065 85074->85075 85077 413d8e 85074->85077 85075->85046 85076 413cb9 85076->85065 85078 413cd6 85076->85078 85088 41ab19 66 API calls 85076->85088 85093 41ab19 66 API calls 85077->85093 85078->85065 85078->85075 85082 413cef 85078->85082 85080->85065 85085 413c9b 85080->85085 85087 41ab19 66 API calls 85080->85087 85089 41ab19 66 API calls 85082->85089 85085->85074 85085->85076 85086->85080 85087->85085 85088->85078 85089->85075 85090->85070 85092->85070 85093->85075 85095 41ac02 85094->85095 85096 41abfd 85094->85096 85103 417f23 66 API calls 85095->85103 85096->85095 85101 41ac22 85096->85101 85098 41ac07 85104 417ebb 6 API calls 85098->85104 85100 410c99 85100->85049 85101->85100 85105 417f23 66 API calls 85101->85105 85103->85098 85105->85098 85106 401230 85107 401241 85106->85107 85108 4012c5 85106->85108 85121 401be0 85107->85121 85110 40126b 85111 4012ae KillTimer SetTimer 85110->85111 85112 42aa61 85110->85112 85113 401298 85110->85113 85111->85108 85116 42aa8b Shell_NotifyIconW 85112->85116 85117 42aa69 Shell_NotifyIconW 85112->85117 85114 4012a2 85113->85114 85115 42aaac 85113->85115 85114->85111 85120 42aaf8 Shell_NotifyIconW 85114->85120 85118 42aad7 Shell_NotifyIconW 85115->85118 85119 42aab5 Shell_NotifyIconW 85115->85119 85116->85111 85117->85111 85118->85111 85119->85111 85120->85111 85122 401bfb 85121->85122 85142 401cde 85121->85142 85143 4013a0 74 API calls 85122->85143 85124 401c0b 85125 42a9a0 LoadStringW 85124->85125 85126 401c18 85124->85126 85128 42a9bb 85125->85128 85144 4021e0 85126->85144 85157 40df50 74 API calls 85128->85157 85129 401c2d 85131 401c3a 85129->85131 85132 42a9cd 85129->85132 85131->85128 85133 401c44 85131->85133 85158 40d3b0 74 API calls 85132->85158 85156 40d3b0 74 API calls 85133->85156 85136 42a9dc 85137 42a9f0 85136->85137 85139 401c53 85136->85139 85159 40d3b0 74 API calls 85137->85159 85141 401cc2 Shell_NotifyIconW 85139->85141 85140 42a9fe 85141->85142 85142->85110 85143->85124 85145 4021f1 85144->85145 85146 42a598 85144->85146 85149 402205 85145->85149 85150 402226 85145->85150 85162 40c740 85146->85162 85148 42a5a2 85160 404020 74 API calls 85149->85160 85161 401380 74 API calls 85150->85161 85153 40220c 85153->85129 85154 40222d 85154->85148 85155 41171a 74 API calls 85154->85155 85155->85153 85156->85139 85157->85139 85158->85136 85159->85140 85160->85153 85161->85154 85163 40c752 85162->85163 85164 40c747 85162->85164 85163->85148 85164->85163 85167 402ae0 74 API calls 85164->85167 85166 42a572 85166->85148 85167->85166 85168 4034b0 85169 4034b9 85168->85169 85170 4034bd 85168->85170 85171 42a0ba 85170->85171 85172 41171a 74 API calls 85170->85172 85173 4034fe 85172->85173 85174 416193 85211 41718c 85174->85211 85176 41619f GetStartupInfoW 85178 4161c2 85176->85178 85212 41aa31 HeapCreate 85178->85212 85180 416212 85214 416e29 GetModuleHandleW 85180->85214 85184 416223 85248 41b669 85184->85248 85187 416231 85188 41623d GetCommandLineW 85187->85188 85317 4117af 66 API calls 85187->85317 85263 42235f GetEnvironmentStringsW 85188->85263 85191 41623c 85191->85188 85192 41624c 85269 4222b1 GetModuleFileNameW 85192->85269 85194 416256 85198 416261 85194->85198 85318 4117af 66 API calls 85194->85318 85273 422082 85198->85273 85199 416272 85286 41186e 85199->85286 85202 416279 85204 416284 85202->85204 85320 4117af 66 API calls 85202->85320 85292 40d7f0 85204->85292 85207 4162b3 85322 411a4b 66 API calls 85207->85322 85210 4162b8 85211->85176 85213 416206 85212->85213 85213->85180 85315 41616a 66 API calls 85213->85315 85215 416e44 85214->85215 85216 416e3d 85214->85216 85218 416fac 85215->85218 85219 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 85215->85219 85323 41177f Sleep GetModuleHandleW 85216->85323 85333 416ad5 69 API calls 85218->85333 85221 416e97 TlsAlloc 85219->85221 85220 416e43 85220->85215 85224 416218 85221->85224 85225 416ee5 TlsSetValue 85221->85225 85224->85184 85316 41616a 66 API calls 85224->85316 85225->85224 85226 416ef6 85225->85226 85324 411a69 6 API calls 85226->85324 85228 416efb 85229 41696e 6 API calls 85228->85229 85230 416f06 85229->85230 85231 41696e 6 API calls 85230->85231 85232 416f16 85231->85232 85233 41696e 6 API calls 85232->85233 85234 416f26 85233->85234 85235 41696e 6 API calls 85234->85235 85236 416f36 85235->85236 85325 41828b InitializeCriticalSectionAndSpinCount 85236->85325 85238 416f43 85238->85218 85239 4169e9 6 API calls 85238->85239 85240 416f57 85239->85240 85240->85218 85326 416ffb 85240->85326 85243 4169e9 6 API calls 85244 416f8a 85243->85244 85244->85218 85245 416f91 85244->85245 85332 416b12 66 API calls 85245->85332 85247 416f99 GetCurrentThreadId 85247->85224 85352 41718c 85248->85352 85250 41b675 GetStartupInfoA 85251 416ffb 66 API calls 85250->85251 85258 41b696 85251->85258 85252 41b8b4 85252->85187 85253 41b831 GetStdHandle 85257 41b7fb 85253->85257 85254 41b896 SetHandleCount 85254->85252 85255 416ffb 66 API calls 85255->85258 85256 41b843 GetFileType 85256->85257 85257->85252 85257->85253 85257->85254 85257->85256 85354 4189e6 InitializeCriticalSectionAndSpinCount 85257->85354 85258->85252 85258->85255 85258->85257 85260 41b77e 85258->85260 85260->85252 85260->85257 85261 41b7a7 GetFileType 85260->85261 85353 4189e6 InitializeCriticalSectionAndSpinCount 85260->85353 85261->85260 85264 422370 85263->85264 85265 422374 85263->85265 85264->85192 85266 416fb6 66 API calls 85265->85266 85267 422395 85266->85267 85268 42239c FreeEnvironmentStringsW 85267->85268 85268->85192 85270 4222e6 85269->85270 85271 416fb6 66 API calls 85270->85271 85272 422329 85270->85272 85271->85272 85272->85194 85274 42209a 85273->85274 85276 416267 85273->85276 85275 416ffb 66 API calls 85274->85275 85279 4220be 85275->85279 85276->85199 85319 4117af 66 API calls 85276->85319 85277 422123 85278 413a88 66 API calls 85277->85278 85278->85276 85279->85276 85279->85277 85280 416ffb 66 API calls 85279->85280 85281 422149 85279->85281 85284 422108 85279->85284 85355 426349 66 API calls 85279->85355 85280->85279 85282 413a88 66 API calls 85281->85282 85282->85276 85284->85279 85356 417d93 10 API calls 85284->85356 85287 41187c 85286->85287 85357 418486 85287->85357 85289 41189a 85290 411421 73 API calls 85289->85290 85291 4118b9 85289->85291 85290->85291 85291->85202 85293 431bcb 85292->85293 85294 40d80c 85292->85294 85295 4092c0 VariantClear 85294->85295 85296 40d847 85295->85296 85361 40eb50 85296->85361 85299 40d877 85364 411ac6 66 API calls 85299->85364 85302 40d888 85365 411b24 66 API calls 85302->85365 85304 40d891 85366 40f370 SystemParametersInfoW SystemParametersInfoW 85304->85366 85306 40d89f 85367 40d6d0 GetCurrentDirectoryW 85306->85367 85308 40d8a7 SystemParametersInfoW 85309 40d8d4 85308->85309 85310 40d8cd FreeLibrary 85308->85310 85311 4092c0 VariantClear 85309->85311 85310->85309 85312 40d8dd 85311->85312 85313 4092c0 VariantClear 85312->85313 85314 40d8e6 85313->85314 85314->85207 85321 411a1f 66 API calls 85314->85321 85315->85180 85316->85184 85317->85191 85318->85198 85319->85199 85320->85204 85321->85207 85322->85210 85323->85220 85324->85228 85325->85238 85329 417004 85326->85329 85328 416f70 85328->85218 85328->85243 85329->85328 85330 417022 Sleep 85329->85330 85334 422452 85329->85334 85331 417037 85330->85331 85331->85328 85331->85329 85332->85247 85333->85224 85335 42245e 85334->85335 85336 422476 85335->85336 85346 422495 85335->85346 85347 417f23 66 API calls 85336->85347 85338 42247b 85348 417ebb 6 API calls 85338->85348 85340 422507 HeapAlloc 85340->85346 85341 42248b 85341->85329 85343 418407 65 API calls 85343->85346 85346->85340 85346->85341 85346->85343 85349 41a74c HeapReAlloc HeapAlloc VirtualAlloc HeapFree VirtualAlloc 85346->85349 85350 42254e LeaveCriticalSection 85346->85350 85351 411afc 6 API calls 85346->85351 85347->85338 85349->85346 85350->85346 85351->85346 85352->85250 85353->85260 85354->85257 85355->85279 85356->85284 85358 41848c 85357->85358 85359 41696e 6 API calls 85358->85359 85360 4184a4 85358->85360 85359->85358 85360->85289 85405 40eb70 85361->85405 85364->85302 85365->85304 85366->85306 85409 401f80 85367->85409 85369 40d6f1 IsDebuggerPresent 85370 431a9d MessageBoxA 85369->85370 85371 40d6ff 85369->85371 85372 431ab6 85370->85372 85371->85372 85373 40d71f 85371->85373 85502 403e90 74 API calls 85372->85502 85479 40f3b0 85373->85479 85377 40d73a GetFullPathNameW 85499 401440 126 API calls 85377->85499 85379 40d77a 85380 40d782 85379->85380 85381 431b09 SetCurrentDirectoryW 85379->85381 85382 40d78b 85380->85382 85503 43604b 6 API calls 85380->85503 85381->85380 85491 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 85382->85491 85385 431b28 85385->85382 85387 431b30 GetModuleFileNameW 85385->85387 85389 431ba4 GetForegroundWindow ShellExecuteW 85387->85389 85390 431b4c 85387->85390 85392 40d7c7 85389->85392 85504 401b70 85390->85504 85391 40d795 85398 40d7a8 85391->85398 85500 40e1e0 96 API calls 85391->85500 85396 40d7d1 SetCurrentDirectoryW 85392->85396 85396->85308 85398->85392 85501 401000 Shell_NotifyIconW 85398->85501 85399 431b66 85511 40d3b0 74 API calls 85399->85511 85402 431b72 GetForegroundWindow ShellExecuteW 85403 431b9f 85402->85403 85403->85392 85404 40eba0 LoadLibraryA GetProcAddress 85404->85299 85406 40d86e 85405->85406 85407 40eb76 LoadLibraryA 85405->85407 85406->85299 85406->85404 85407->85406 85408 40eb87 GetProcAddress 85407->85408 85408->85406 85512 40e680 74 API calls 85409->85512 85411 401f90 85513 402940 74 API calls 85411->85513 85413 401fa2 GetModuleFileNameW 85514 40ff90 85413->85514 85415 401fbd 85526 4107b0 74 API calls 85415->85526 85417 401fd6 85418 401b70 74 API calls 85417->85418 85419 401fe4 85418->85419 85527 4019e0 75 API calls 85419->85527 85421 401ff2 85422 4092c0 VariantClear 85421->85422 85423 402002 85422->85423 85424 401b70 74 API calls 85423->85424 85425 40201c 85424->85425 85528 4019e0 75 API calls 85425->85528 85427 40202c 85428 401b70 74 API calls 85427->85428 85429 40203c 85428->85429 85529 40c3e0 74 API calls 85429->85529 85431 40204d 85530 40c060 85431->85530 85435 40206e 85536 4115d0 78 API calls 85435->85536 85437 40207d 85438 42c174 85437->85438 85439 402088 85437->85439 85547 401a70 74 API calls 85438->85547 85537 4115d0 78 API calls 85439->85537 85442 42c189 85548 401a70 74 API calls 85442->85548 85443 402093 85443->85442 85444 40209e 85443->85444 85538 4115d0 78 API calls 85444->85538 85447 42c1a7 85449 42c1b0 GetModuleFileNameW 85447->85449 85448 4020a9 85448->85449 85450 4020b4 85448->85450 85549 401a70 74 API calls 85449->85549 85539 4115d0 78 API calls 85450->85539 85453 4020bf 85455 402107 85453->85455 85464 42c20a 85453->85464 85540 401a70 74 API calls 85453->85540 85454 42c1e2 85550 40df50 74 API calls 85454->85550 85458 402119 85455->85458 85455->85464 85457 42c1f1 85551 401a70 74 API calls 85457->85551 85461 42c243 85458->85461 85542 40e7e0 75 API calls 85458->85542 85462 4020e5 85541 401a70 74 API calls 85462->85541 85463 42c201 85463->85464 85552 401a70 74 API calls 85464->85552 85467 402132 85543 40d030 75 API calls 85467->85543 85470 40213e 85471 4092c0 VariantClear 85470->85471 85474 402148 85471->85474 85473 402184 85476 4092c0 VariantClear 85473->85476 85474->85473 85544 40d030 75 API calls 85474->85544 85545 40e640 75 API calls 85474->85545 85546 401a70 74 API calls 85474->85546 85478 402196 85476->85478 85478->85369 85480 42ccf4 85479->85480 85481 40f3c9 85479->85481 85484 42cd05 GetOpenFileNameW 85480->85484 86213 40ffb0 75 API calls 85481->86213 85483 40f3d2 86214 410130 SHGetMalloc 85483->86214 85484->85481 85486 40d732 85484->85486 85486->85377 85486->85379 85487 40f3d9 86219 410020 87 API calls 85487->86219 85489 40f3e7 86220 40f400 85489->86220 85492 42b9d3 85491->85492 85493 41025a LoadImageW RegisterClassExW 85491->85493 86265 443e8f EnumResourceNamesW LoadImageW 85492->86265 86264 4102f0 7 API calls 85493->86264 85496 42b9da 85497 40d790 85498 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 85497->85498 85498->85391 85499->85379 85500->85398 85501->85392 85502->85379 85503->85385 85505 401b76 85504->85505 85506 41171a 74 API calls 85505->85506 85509 401bc5 85505->85509 85507 401bad 85506->85507 85508 41171a 74 API calls 85507->85508 85508->85509 85510 40d3b0 74 API calls 85509->85510 85510->85399 85511->85402 85512->85411 85513->85413 85553 40f5e0 85514->85553 85517 40ffa6 85517->85415 85519 42b6d8 85522 42b6e6 85519->85522 85609 434fe1 85519->85609 85521 413a88 66 API calls 85523 42b6f5 85521->85523 85522->85521 85524 434fe1 105 API calls 85523->85524 85525 42b702 85524->85525 85525->85415 85526->85417 85527->85421 85528->85427 85529->85431 85531 41171a 74 API calls 85530->85531 85532 40c088 85531->85532 85533 41171a 74 API calls 85532->85533 85534 402061 85533->85534 85535 401a70 74 API calls 85534->85535 85535->85435 85536->85437 85537->85443 85538->85448 85539->85453 85540->85462 85541->85455 85542->85467 85543->85470 85544->85474 85545->85474 85546->85474 85547->85442 85548->85447 85549->85454 85550->85457 85551->85463 85552->85474 85613 40f580 85553->85613 85555 40f5f8 85621 40f6d0 85555->85621 85560 42b2ee 85650 4151b0 85560->85650 85562 40f679 85562->85560 85563 40f681 85562->85563 85637 414e94 85563->85637 85568 40f68b 85568->85517 85572 452574 85568->85572 85569 42b31d 85656 415484 85569->85656 85571 42b33d 85573 41557c 104 API calls 85572->85573 85574 4525df 85573->85574 86158 4523ce 85574->86158 85577 4525fc 85577->85519 85578 4151b0 80 API calls 85579 45261d 85578->85579 85580 4151b0 80 API calls 85579->85580 85581 45262e 85580->85581 85582 4151b0 80 API calls 85581->85582 85583 452649 85582->85583 85584 4151b0 80 API calls 85583->85584 85585 452666 85584->85585 85586 41557c 104 API calls 85585->85586 85587 452682 85586->85587 85588 4138ba 66 API calls 85587->85588 85589 45268e 85588->85589 85590 4138ba 66 API calls 85589->85590 85591 45269b 85590->85591 85592 4151b0 80 API calls 85591->85592 85593 4526ac 85592->85593 85594 44afdc GetSystemTimeAsFileTime 85593->85594 85595 4526bf 85594->85595 85596 4526d5 85595->85596 85597 4526fd 85595->85597 85600 413a88 66 API calls 85596->85600 85598 452704 85597->85598 85599 45275b 85597->85599 86164 44b195 85598->86164 85602 413a88 66 API calls 85599->85602 85603 4526df 85600->85603 85605 452759 85602->85605 85606 413a88 66 API calls 85603->85606 85604 452753 85607 413a88 66 API calls 85604->85607 85605->85519 85608 4526e8 85606->85608 85607->85605 85608->85519 85610 434ff1 85609->85610 85611 434feb 85609->85611 85610->85522 85612 414e94 105 API calls 85611->85612 85612->85610 85614 429440 85613->85614 85615 40f589 85613->85615 85616 40f58f WideCharToMultiByte 85615->85616 85617 40f5d8 85616->85617 85618 40f5ad 85616->85618 85617->85555 85619 41171a 74 API calls 85618->85619 85620 40f5bb WideCharToMultiByte 85619->85620 85620->85555 85622 40f6dd 85621->85622 85669 40f790 85622->85669 85625 414e06 85689 414d40 85625->85689 85627 40f666 85627->85560 85628 40f450 85627->85628 85632 40f45a 85628->85632 85629 4151b0 80 API calls 85629->85632 85631 42936d 85633 41557c 104 API calls 85631->85633 85632->85629 85632->85631 85636 40f531 85632->85636 85772 41557c 85632->85772 85634 429394 85633->85634 85635 4151b0 80 API calls 85634->85635 85635->85636 85636->85562 85638 414ea0 85637->85638 85639 414eb4 85638->85639 85641 414ed1 85638->85641 85911 417f23 66 API calls 85639->85911 85642 415965 67 API calls 85641->85642 85646 414ec9 85641->85646 85644 414ee9 85642->85644 85643 414eb9 85912 417ebb 6 API calls 85643->85912 85895 414e1d 85644->85895 85646->85568 85980 41511a 85650->85980 85652 4151c8 85653 44afdc 85652->85653 86151 4431e0 85653->86151 85655 44affd 85655->85569 85657 415490 85656->85657 85658 4154bb 85657->85658 85659 41549e 85657->85659 85661 415965 67 API calls 85658->85661 86155 417f23 66 API calls 85659->86155 85663 4154c3 85661->85663 85662 4154a3 86156 417ebb 6 API calls 85662->86156 85665 4152e7 70 API calls 85663->85665 85666 4154cf 85665->85666 86157 4154e8 LeaveCriticalSection LeaveCriticalSection 85666->86157 85668 4154b3 85668->85571 85671 40f7ae 85669->85671 85670 42a349 85671->85670 85673 40f628 85671->85673 85674 415258 85671->85674 85673->85625 85675 415285 85674->85675 85676 415268 85674->85676 85675->85676 85678 41528c 85675->85678 85685 417f23 66 API calls 85676->85685 85687 41c551 102 API calls 85678->85687 85679 41526d 85686 417ebb 6 API calls 85679->85686 85682 4152b2 85683 41527d 85682->85683 85688 4191c9 100 API calls 85682->85688 85683->85671 85685->85679 85687->85682 85688->85683 85692 414d4c 85689->85692 85690 414d5f 85741 417f23 66 API calls 85690->85741 85692->85690 85694 414d95 85692->85694 85693 414d64 85742 417ebb 6 API calls 85693->85742 85708 41e28c 85694->85708 85697 414d9a 85698 414da1 85697->85698 85699 414dae 85697->85699 85743 417f23 66 API calls 85698->85743 85701 414dd6 85699->85701 85702 414db6 85699->85702 85726 41dfd8 85701->85726 85744 417f23 66 API calls 85702->85744 85705 414d74 85705->85627 85709 41e298 85708->85709 85710 418407 66 API calls 85709->85710 85721 41e2a6 85710->85721 85711 41e322 85713 416fb6 66 API calls 85711->85713 85715 41e32c 85713->85715 85714 41e3b0 85714->85697 85720 41e31b 85715->85720 85751 4189e6 InitializeCriticalSectionAndSpinCount 85715->85751 85718 418344 66 API calls 85718->85721 85719 41e351 85722 41e35c 85719->85722 85723 41e36f EnterCriticalSection 85719->85723 85746 41e3bb 85720->85746 85721->85711 85721->85718 85721->85720 85749 4159a6 67 API calls 85721->85749 85750 415a14 LeaveCriticalSection LeaveCriticalSection 85721->85750 85724 413a88 66 API calls 85722->85724 85723->85720 85724->85720 85735 41dffb 85726->85735 85727 41e015 85756 417f23 66 API calls 85727->85756 85729 41e1e9 85729->85727 85731 41e247 85729->85731 85730 41e01a 85757 417ebb 6 API calls 85730->85757 85753 425db0 85731->85753 85735->85727 85735->85729 85758 4136bc 78 API calls 85735->85758 85737 41e1e2 85737->85729 85759 4136bc 78 API calls 85737->85759 85739 41e201 85739->85729 85760 4136bc 78 API calls 85739->85760 85741->85693 85743->85705 85744->85705 85745 414dfc LeaveCriticalSection LeaveCriticalSection 85745->85705 85752 41832d LeaveCriticalSection 85746->85752 85748 41e3c2 85748->85714 85749->85721 85750->85721 85751->85719 85752->85748 85761 425ce4 85753->85761 85755 414de1 85755->85745 85756->85730 85758->85737 85759->85739 85760->85729 85762 425cf0 85761->85762 85763 425d03 85762->85763 85766 425d41 85762->85766 85764 417f23 66 API calls 85763->85764 85765 425d08 85764->85765 85767 417ebb 6 API calls 85765->85767 85768 4255c4 131 API calls 85766->85768 85771 425d17 85767->85771 85769 425d5b 85768->85769 85770 425d82 LeaveCriticalSection 85769->85770 85770->85771 85771->85755 85776 415588 85772->85776 85773 415596 85803 417f23 66 API calls 85773->85803 85775 4155c4 85785 415965 85775->85785 85776->85773 85776->85775 85778 41559b 85804 417ebb 6 API calls 85778->85804 85784 4155ab 85784->85632 85786 415977 85785->85786 85787 415999 EnterCriticalSection 85785->85787 85786->85787 85788 41597f 85786->85788 85789 4155cc 85787->85789 85790 418407 66 API calls 85788->85790 85791 4154f2 85789->85791 85790->85789 85792 415512 85791->85792 85793 415502 85791->85793 85794 415524 85792->85794 85806 4152e7 85792->85806 85860 417f23 66 API calls 85793->85860 85823 41486c 85794->85823 85802 415507 85805 4155f7 LeaveCriticalSection LeaveCriticalSection 85802->85805 85803->85778 85805->85784 85807 41531a 85806->85807 85808 4152fa 85806->85808 85810 41453a 66 API calls 85807->85810 85861 417f23 66 API calls 85808->85861 85812 415320 85810->85812 85811 4152ff 85862 417ebb 6 API calls 85811->85862 85814 41efd4 70 API calls 85812->85814 85815 415335 85814->85815 85816 4153a9 85815->85816 85818 415364 85815->85818 85822 41530f 85815->85822 85863 417f23 66 API calls 85816->85863 85819 41efd4 70 API calls 85818->85819 85818->85822 85820 415404 85819->85820 85821 41efd4 70 API calls 85820->85821 85820->85822 85821->85822 85822->85794 85824 4148a7 85823->85824 85825 414885 85823->85825 85829 41453a 85824->85829 85825->85824 85826 41453a 66 API calls 85825->85826 85827 4148a0 85826->85827 85864 41c3cf 100 API calls 85827->85864 85830 414549 85829->85830 85834 41455e 85829->85834 85865 417f23 66 API calls 85830->85865 85832 41454e 85866 417ebb 6 API calls 85832->85866 85835 41efd4 85834->85835 85836 41efe0 85835->85836 85837 41efe8 85836->85837 85840 41f003 85836->85840 85887 417f36 66 API calls 85837->85887 85839 41f011 85889 417f36 66 API calls 85839->85889 85840->85839 85843 41f052 85840->85843 85841 41efed 85888 417f23 66 API calls 85841->85888 85867 41ba3b 85843->85867 85845 41f016 85890 417f23 66 API calls 85845->85890 85848 41f058 85850 41f065 85848->85850 85851 41f07b 85848->85851 85849 41f01d 85891 417ebb 6 API calls 85849->85891 85877 41ef5f 85850->85877 85892 417f23 66 API calls 85851->85892 85853 41eff5 85853->85802 85856 41f073 85894 41f0a6 LeaveCriticalSection 85856->85894 85857 41f080 85893 417f36 66 API calls 85857->85893 85860->85802 85861->85811 85863->85822 85864->85824 85865->85832 85868 41ba47 85867->85868 85869 41baa2 85868->85869 85870 418407 66 API calls 85868->85870 85871 41baa7 EnterCriticalSection 85869->85871 85873 41bac4 85869->85873 85872 41ba73 85870->85872 85871->85873 85874 41ba8a 85872->85874 85875 4189e6 InitializeCriticalSectionAndSpinCount 85872->85875 85873->85848 85876 41bad2 LeaveCriticalSection 85874->85876 85875->85874 85876->85869 85878 41b9c4 66 API calls 85877->85878 85879 41ef6e 85878->85879 85880 41ef84 SetFilePointer 85879->85880 85881 41ef74 85879->85881 85883 41efa3 85880->85883 85884 41ef9b GetLastError 85880->85884 85882 417f23 66 API calls 85881->85882 85886 41ef79 85882->85886 85885 417f49 66 API calls 85883->85885 85883->85886 85884->85883 85885->85886 85886->85856 85887->85841 85888->85853 85889->85845 85890->85849 85892->85857 85893->85856 85894->85853 85896 414e31 85895->85896 85897 414e4d 85895->85897 85941 417f23 66 API calls 85896->85941 85899 41486c 100 API calls 85897->85899 85903 414e46 85897->85903 85902 414e59 85899->85902 85900 414e36 85942 417ebb 6 API calls 85900->85942 85914 41e680 85902->85914 85913 414f08 LeaveCriticalSection LeaveCriticalSection 85903->85913 85906 41453a 66 API calls 85907 414e67 85906->85907 85918 41e5b3 85907->85918 85909 414e6d 85909->85903 85910 413a88 66 API calls 85909->85910 85910->85903 85911->85643 85913->85646 85915 41e690 85914->85915 85916 414e61 85914->85916 85915->85916 85917 413a88 66 API calls 85915->85917 85916->85906 85917->85916 85919 41e5bf 85918->85919 85920 41e5e2 85919->85920 85921 41e5c7 85919->85921 85922 41e5f0 85920->85922 85927 41e631 85920->85927 85958 417f36 66 API calls 85921->85958 85960 417f36 66 API calls 85922->85960 85925 41e5cc 85959 417f23 66 API calls 85925->85959 85926 41e5f5 85961 417f23 66 API calls 85926->85961 85930 41ba3b 67 API calls 85927->85930 85933 41e637 85930->85933 85931 41e5d4 85931->85909 85932 41e5fc 85962 417ebb 6 API calls 85932->85962 85935 41e652 85933->85935 85936 41e644 85933->85936 85963 417f23 66 API calls 85935->85963 85943 41e517 85936->85943 85939 41e64c 85964 41e676 LeaveCriticalSection 85939->85964 85941->85900 85965 41b9c4 85943->85965 85945 41e57d 85978 41b93e 67 API calls 85945->85978 85947 41e527 85947->85945 85949 41b9c4 66 API calls 85947->85949 85957 41e55b 85947->85957 85948 41e585 85954 41e5a7 85948->85954 85979 417f49 66 API calls 85948->85979 85951 41e552 85949->85951 85950 41b9c4 66 API calls 85952 41e567 CloseHandle 85950->85952 85955 41b9c4 66 API calls 85951->85955 85952->85945 85956 41e573 GetLastError 85952->85956 85954->85939 85955->85957 85956->85945 85957->85945 85957->85950 85958->85925 85959->85931 85960->85926 85961->85932 85963->85939 85964->85931 85966 41b9d1 85965->85966 85967 41b9e9 85965->85967 85968 417f36 66 API calls 85966->85968 85970 417f36 66 API calls 85967->85970 85972 41ba2e 85967->85972 85969 41b9d6 85968->85969 85971 417f23 66 API calls 85969->85971 85973 41ba17 85970->85973 85974 41b9de 85971->85974 85972->85947 85975 417f23 66 API calls 85973->85975 85974->85947 85976 41ba1e 85975->85976 85977 417ebb 6 API calls 85976->85977 85977->85972 85978->85948 85979->85954 85981 415126 85980->85981 85982 41513a 85981->85982 85983 41516f 85981->85983 85985 415164 85981->85985 86009 417f23 66 API calls 85982->86009 85984 415965 67 API calls 85983->85984 85986 415177 85984->85986 85985->85652 85993 414f10 85986->85993 85989 415154 86010 417ebb 6 API calls 85989->86010 85997 414f2e 85993->85997 85999 414f4c 85993->85999 85994 414f37 86062 417f23 66 API calls 85994->86062 85996 414f3c 86063 417ebb 6 API calls 85996->86063 85997->85994 85997->85999 86006 414f8b 85997->86006 86011 4151a6 LeaveCriticalSection LeaveCriticalSection 85999->86011 86001 4150d5 86066 417f23 66 API calls 86001->86066 86002 4150a9 86065 417f23 66 API calls 86002->86065 86003 41453a 66 API calls 86003->86006 86006->85999 86006->86001 86006->86002 86006->86003 86012 41ed9e 86006->86012 86042 41e6b1 86006->86042 86064 41ee9b 66 API calls 86006->86064 86009->85989 86011->85985 86013 41edaa 86012->86013 86014 41edb2 86013->86014 86015 41edcd 86013->86015 86136 417f36 66 API calls 86014->86136 86016 41eddb 86015->86016 86022 41ee1c 86015->86022 86138 417f36 66 API calls 86016->86138 86018 41edb7 86137 417f23 66 API calls 86018->86137 86021 41ede0 86139 417f23 66 API calls 86021->86139 86023 41ee29 86022->86023 86024 41ee3d 86022->86024 86141 417f36 66 API calls 86023->86141 86027 41ba3b 67 API calls 86024->86027 86030 41ee43 86027->86030 86028 41ede7 86140 417ebb 6 API calls 86028->86140 86029 41ee2e 86142 417f23 66 API calls 86029->86142 86032 41ee50 86030->86032 86033 41ee66 86030->86033 86067 41e7dc 86032->86067 86143 417f23 66 API calls 86033->86143 86035 41edbf 86035->86006 86038 41ee5e 86145 41ee91 LeaveCriticalSection 86038->86145 86039 41ee6b 86144 417f36 66 API calls 86039->86144 86043 41e6c1 86042->86043 86047 41e6de 86042->86047 86149 417f23 66 API calls 86043->86149 86045 41e6c6 86150 417ebb 6 API calls 86045->86150 86048 41e713 86047->86048 86054 41e6d6 86047->86054 86146 423600 86047->86146 86050 41453a 66 API calls 86048->86050 86051 41e727 86050->86051 86052 41ed9e 78 API calls 86051->86052 86053 41e72e 86052->86053 86053->86054 86055 41453a 66 API calls 86053->86055 86054->86006 86056 41e751 86055->86056 86056->86054 86057 41453a 66 API calls 86056->86057 86058 41e75d 86057->86058 86058->86054 86059 41453a 66 API calls 86058->86059 86060 41e769 86059->86060 86061 41453a 66 API calls 86060->86061 86061->86054 86062->85996 86064->86006 86065->85996 86066->85996 86068 41e813 86067->86068 86069 41e7f8 86067->86069 86071 41e822 86068->86071 86073 41e849 86068->86073 86070 417f36 66 API calls 86069->86070 86072 41e7fd 86070->86072 86074 417f36 66 API calls 86071->86074 86076 417f23 66 API calls 86072->86076 86075 41e868 86073->86075 86090 41e87c 86073->86090 86077 41e827 86074->86077 86078 417f36 66 API calls 86075->86078 86087 41e805 86076->86087 86080 417f23 66 API calls 86077->86080 86083 41e86d 86078->86083 86079 41e8d4 86082 417f36 66 API calls 86079->86082 86081 41e82e 86080->86081 86084 417ebb 6 API calls 86081->86084 86085 41e8d9 86082->86085 86086 417f23 66 API calls 86083->86086 86084->86087 86088 417f23 66 API calls 86085->86088 86089 41e874 86086->86089 86087->86038 86088->86089 86093 417ebb 6 API calls 86089->86093 86090->86079 86090->86087 86091 41e8b0 86090->86091 86092 41e8f5 86090->86092 86091->86079 86098 41e8bb ReadFile 86091->86098 86095 416fb6 66 API calls 86092->86095 86093->86087 86099 41e90b 86095->86099 86096 41ed62 GetLastError 86102 41ebe8 86096->86102 86103 41ed6f 86096->86103 86097 41e9e7 86097->86096 86105 41e9fb 86097->86105 86098->86096 86098->86097 86100 41e931 86099->86100 86101 41e913 86099->86101 86106 423462 68 API calls 86100->86106 86104 417f23 66 API calls 86101->86104 86110 417f49 66 API calls 86102->86110 86130 41eb6d 86102->86130 86107 417f23 66 API calls 86103->86107 86109 41e918 86104->86109 86114 41ea17 86105->86114 86115 41ec2d 86105->86115 86105->86130 86111 41e93d 86106->86111 86108 41ed74 86107->86108 86112 417f36 66 API calls 86108->86112 86113 417f36 66 API calls 86109->86113 86110->86130 86111->86098 86112->86130 86113->86087 86117 41ea7d ReadFile 86114->86117 86125 41eafa 86114->86125 86118 41eca5 ReadFile 86115->86118 86115->86130 86116 413a88 66 API calls 86116->86087 86119 41ea9b GetLastError 86117->86119 86128 41eaa5 86117->86128 86120 41ecc4 GetLastError 86118->86120 86126 41ecce 86118->86126 86119->86114 86119->86128 86120->86115 86120->86126 86121 41ebbe MultiByteToWideChar 86122 41ebe2 GetLastError 86121->86122 86121->86130 86122->86102 86123 41eb75 86131 41eb32 86123->86131 86132 41ebac 86123->86132 86124 41eb68 86127 417f23 66 API calls 86124->86127 86125->86123 86125->86124 86125->86130 86125->86131 86126->86115 86129 423462 68 API calls 86126->86129 86127->86130 86128->86114 86133 423462 68 API calls 86128->86133 86129->86126 86130->86087 86130->86116 86131->86121 86134 423462 68 API calls 86132->86134 86133->86128 86135 41ebbb 86134->86135 86135->86121 86136->86018 86137->86035 86138->86021 86139->86028 86141->86029 86142->86028 86143->86039 86144->86038 86145->86035 86147 416fb6 66 API calls 86146->86147 86148 423615 86147->86148 86148->86048 86149->86045 86154 414cef GetSystemTimeAsFileTime 86151->86154 86153 4431ef 86153->85655 86154->86153 86155->85662 86157->85668 86162 4523e1 86158->86162 86159 4151b0 80 API calls 86159->86162 86160 452553 86160->85577 86160->85578 86161 44afdc GetSystemTimeAsFileTime 86161->86162 86162->86159 86162->86160 86162->86161 86163 41557c 104 API calls 86162->86163 86163->86162 86165 44b1b4 86164->86165 86166 44b1a6 86164->86166 86168 44b1ca 86165->86168 86169 414e06 137 API calls 86165->86169 86170 44b1c2 86165->86170 86167 414e06 137 API calls 86166->86167 86167->86165 86199 4352d1 80 API calls 86168->86199 86171 44b2c1 86169->86171 86170->85604 86171->86168 86173 44b2cf 86171->86173 86177 414e94 105 API calls 86173->86177 86182 44b2dc 86173->86182 86174 44b20d 86175 44b211 86174->86175 86176 44b23b 86174->86176 86179 414e94 105 API calls 86175->86179 86181 44b21e 86175->86181 86200 43526e 86176->86200 86177->86182 86179->86181 86180 44b22e 86180->85604 86181->86180 86184 414e94 105 API calls 86181->86184 86182->85604 86183 44b242 86185 44b270 86183->86185 86186 44b248 86183->86186 86184->86180 86210 44b0af 110 API calls 86185->86210 86188 44b255 86186->86188 86191 414e94 105 API calls 86186->86191 86189 44b265 86188->86189 86192 414e94 105 API calls 86188->86192 86189->85604 86190 44b276 86211 43522c 66 API calls 86190->86211 86191->86188 86192->86189 86194 44b27c 86195 44b289 86194->86195 86196 414e94 105 API calls 86194->86196 86197 44b299 86195->86197 86198 414e94 105 API calls 86195->86198 86196->86195 86197->85604 86198->86197 86199->86174 86201 4138ba 66 API calls 86200->86201 86202 43527d 86201->86202 86203 4138ba 66 API calls 86202->86203 86204 43528d 86203->86204 86205 4138ba 66 API calls 86204->86205 86206 43529d 86205->86206 86208 4352bc 86206->86208 86212 43522c 66 API calls 86206->86212 86208->86183 86209 4352c8 86209->86183 86210->86190 86211->86194 86212->86209 86213->85483 86215 410148 SHGetDesktopFolder 86214->86215 86218 4101a3 86214->86218 86216 41015a 86215->86216 86215->86218 86217 41018a SHGetPathFromIDListW 86216->86217 86216->86218 86217->86218 86218->85487 86219->85489 86221 40f5e0 151 API calls 86220->86221 86222 40f417 86221->86222 86223 42ca37 86222->86223 86224 40f42c 86222->86224 86225 42ca1f 86222->86225 86226 452574 139 API calls 86223->86226 86258 4037e0 138 API calls 86224->86258 86259 43717f 109 API calls 86225->86259 86227 42ca50 86226->86227 86230 42ca76 86227->86230 86231 42ca54 86227->86231 86235 41171a 74 API calls 86230->86235 86234 434fe1 105 API calls 86231->86234 86232 40f446 86232->85486 86233 42ca2d 86233->86223 86236 42ca5e 86234->86236 86250 42cacc 86235->86250 86260 43717f 109 API calls 86236->86260 86238 42ca6c 86238->86230 86239 42ccc3 86240 413a88 66 API calls 86239->86240 86241 42cccd 86240->86241 86242 434fe1 105 API calls 86241->86242 86243 42ccda 86242->86243 86247 401b70 74 API calls 86247->86250 86250->86239 86250->86247 86251 402cc0 74 API calls 86250->86251 86252 4026a0 86250->86252 86261 445051 74 API calls 86250->86261 86262 44c80c 86 API calls 86250->86262 86263 44b408 74 API calls 86250->86263 86251->86250 86253 4026af 86252->86253 86255 40276b 86252->86255 86254 41171a 74 API calls 86253->86254 86253->86255 86256 4026ee 86253->86256 86254->86256 86255->86250 86256->86255 86257 41171a 74 API calls 86256->86257 86257->86256 86258->86232 86259->86233 86260->86238 86261->86250 86262->86250 86263->86250 86264->85497 86265->85496 86266 431914 86267 431920 86266->86267 86268 431928 86267->86268 86269 43193d 86267->86269 86530 45e62e 115 API calls 86268->86530 86531 47f2b4 173 API calls 86269->86531 86272 43194a 86309 4095b0 86272->86309 86532 45e62e 115 API calls 86272->86532 86273 409708 86276 4097af 86276->86273 86517 40d590 VariantClear 86276->86517 86277 4315b8 WaitForSingleObject 86280 4315d6 GetExitCodeProcess CloseHandle 86277->86280 86277->86309 86279 431623 Sleep 86284 43163b timeGetTime 86279->86284 86304 409894 86279->86304 86521 40d590 VariantClear 86280->86521 86284->86304 86285 40986e Sleep 86289 409880 timeGetTime 86285->86289 86285->86304 86288 4098f1 TranslateMessage DispatchMessageW 86288->86309 86289->86304 86290 431673 CloseHandle 86290->86304 86291 43170c GetExitCodeProcess CloseHandle 86291->86304 86292 46e641 133 API calls 86292->86304 86295 46dd22 132 API calls 86295->86304 86297 431781 Sleep 86297->86309 86300 45e62e 115 API calls 86300->86309 86302 40d590 VariantClear 86302->86304 86304->86290 86304->86291 86304->86292 86304->86295 86304->86297 86304->86302 86308 4092c0 VariantClear 86304->86308 86304->86309 86518 447e59 74 API calls 86304->86518 86519 453b07 76 API calls 86304->86519 86520 4646a2 75 API calls 86304->86520 86522 444233 87 API calls 86304->86522 86523 457509 VariantClear 86304->86523 86524 404120 86304->86524 86528 4717e3 VariantClear 86304->86528 86529 436272 6 API calls 86304->86529 86307 4319c9 VariantClear 86307->86309 86308->86304 86309->86273 86309->86276 86309->86277 86309->86279 86309->86285 86309->86288 86309->86300 86309->86304 86309->86307 86310 4092c0 VariantClear 86309->86310 86312 40b380 86309->86312 86336 409340 86309->86336 86369 409030 86309->86369 86383 40d300 86309->86383 86388 40d320 86309->86388 86394 409a40 86309->86394 86533 40e380 VariantClear 86309->86533 86310->86309 86313 40b3a5 86312->86313 86314 40b53d 86312->86314 86315 430a99 86313->86315 86321 40b3b6 86313->86321 86534 45e62e 115 API calls 86314->86534 86535 45e62e 115 API calls 86315->86535 86318 430aae 86323 4092c0 VariantClear 86318->86323 86319 40b528 86319->86309 86321->86318 86324 40b3f2 86321->86324 86335 40b4fd 86321->86335 86322 430dc9 86322->86322 86323->86319 86325 40b429 86324->86325 86327 430ae9 VariantClear 86324->86327 86328 40b476 86324->86328 86333 40b43b 86325->86333 86536 40e380 VariantClear 86325->86536 86326 40b4eb 86326->86335 86537 40e380 VariantClear 86326->86537 86327->86333 86328->86326 86331 430d08 86328->86331 86329 430d41 VariantClear 86329->86335 86331->86329 86331->86335 86333->86328 86334 41171a 74 API calls 86333->86334 86334->86328 86335->86319 86538 45e62e 115 API calls 86335->86538 86337 409386 86336->86337 86362 409395 86336->86362 86539 4042f0 74 API calls 86337->86539 86340 42fba9 86543 45e62e 115 API calls 86340->86543 86342 42fc07 86545 45e62e 115 API calls 86342->86545 86343 42fc85 86547 4781ae 139 API calls 86343->86547 86347 42fd4f 86351 4092c0 VariantClear 86347->86351 86348 42fcd8 86549 47f2b4 173 API calls 86348->86549 86349 42fc9c 86368 409484 86349->86368 86548 45e62e 115 API calls 86349->86548 86350 42fd39 86551 45e62e 115 API calls 86350->86551 86351->86368 86353 42fce9 86353->86368 86550 45e62e 115 API calls 86353->86550 86356 40946f 86540 409210 VariantClear 86356->86540 86358 4094c1 86358->86368 86541 404260 75 API calls 86358->86541 86361 40947b 86363 4092c0 VariantClear 86361->86363 86362->86340 86362->86342 86362->86343 86362->86347 86362->86348 86362->86350 86362->86356 86362->86358 86362->86361 86365 4092c0 VariantClear 86362->86365 86362->86368 86542 453155 74 API calls 86362->86542 86544 40c620 117 API calls 86362->86544 86546 45e62e 115 API calls 86362->86546 86363->86368 86365->86362 86366 4094e1 86367 4092c0 VariantClear 86366->86367 86367->86368 86368->86309 86552 409110 116 API calls 86369->86552 86371 42ceb6 86562 410ae0 VariantClear 86371->86562 86373 42cebf 86374 40906e 86374->86371 86375 42cea9 86374->86375 86377 4090a4 86374->86377 86561 45e62e 115 API calls 86375->86561 86553 404160 86377->86553 86380 4090f0 86380->86309 86381 4092c0 VariantClear 86382 4090be 86381->86382 86382->86380 86382->86381 86384 4292e3 86383->86384 86385 40d30c 86383->86385 86386 429323 86384->86386 86387 4292fd TranslateAcceleratorW 86384->86387 86385->86309 86386->86309 86387->86385 86389 4296d0 86388->86389 86392 40d32f 86388->86392 86389->86309 86390 42972a IsDialogMessageW 86391 40d33c 86390->86391 86390->86392 86391->86309 86392->86390 86392->86391 86697 4340ec GetClassLongW 86392->86697 86395 409a66 86394->86395 86396 41171a 74 API calls 86395->86396 86456 40aade 86395->86456 86397 409a9c 86396->86397 86399 41171a 74 API calls 86397->86399 86401 409abd 86399->86401 86400 42cee9 86402 41171a 74 API calls 86400->86402 86403 409aeb CharUpperBuffW 86401->86403 86405 409b09 86401->86405 86401->86456 86444 42cf10 86402->86444 86403->86405 86447 409b88 86405->86447 86700 47d10e 149 API calls 86405->86700 86407 4092c0 VariantClear 86408 42e5e0 86407->86408 86732 410ae0 VariantClear 86408->86732 86410 42e5f2 86411 409e4a 86413 41171a 74 API calls 86411->86413 86417 409ea4 86411->86417 86411->86444 86412 40aa5b 86414 41171a 74 API calls 86412->86414 86413->86417 86430 40aa81 86414->86430 86415 409ed0 86419 42d50d 86415->86419 86478 409ef8 86415->86478 86710 40b800 VariantClear VariantClear 86415->86710 86417->86415 86418 41171a 74 API calls 86417->86418 86420 42d480 86418->86420 86425 42d527 86419->86425 86711 40b800 VariantClear VariantClear 86419->86711 86424 42d491 86420->86424 86706 44b3f6 74 API calls 86420->86706 86421 42d195 VariantClear 86421->86447 86422 40a3a7 86427 40a415 86422->86427 86476 42db5c 86422->86476 86707 40df50 74 API calls 86424->86707 86425->86478 86712 40e2e0 VariantClear 86425->86712 86432 41171a 74 API calls 86427->86432 86428 4092c0 VariantClear 86428->86447 86438 41171a 74 API calls 86430->86438 86450 40a41c 86432->86450 86435 41171a 74 API calls 86435->86447 86438->86456 86439 42d4a6 86708 4530b3 74 API calls 86439->86708 86441 42db96 86718 45e62e 115 API calls 86441->86718 86443 42d128 86446 4092c0 VariantClear 86443->86446 86731 45e62e 115 API calls 86444->86731 86445 42d4d7 86709 4530b3 74 API calls 86445->86709 86452 42d131 86446->86452 86447->86411 86447->86412 86447->86421 86447->86428 86447->86430 86447->86435 86447->86443 86447->86444 86448 42d20c 86447->86448 86454 42dbb9 86447->86454 86701 40c3e0 74 API calls 86447->86701 86702 40c620 117 API calls 86447->86702 86704 40be00 74 API calls 86447->86704 86705 40e380 VariantClear 86447->86705 86448->86309 86464 40a481 86450->86464 86719 40c8a0 VariantClear 86450->86719 86703 410ae0 VariantClear 86452->86703 86454->86407 86699 401380 74 API calls 86456->86699 86458 41171a 74 API calls 86458->86478 86459 44b3f6 74 API calls 86459->86478 86461 4092c0 VariantClear 86492 40a534 86461->86492 86462 411421 73 API calls 86462->86478 86463 402cc0 74 API calls 86463->86478 86465 40a4ed 86464->86465 86466 42dc1e VariantClear 86464->86466 86464->86492 86469 40a4ff 86465->86469 86720 40e380 VariantClear 86465->86720 86466->86469 86471 41171a 74 API calls 86469->86471 86469->86492 86471->86492 86474 42deb6 VariantClear 86474->86492 86475 40a73c 86477 42e237 86475->86477 86485 40a76b 86475->86485 86717 4721e5 VariantClear 86476->86717 86724 46e709 VariantClear VariantClear 86477->86724 86478->86422 86478->86441 86478->86456 86478->86458 86478->86459 86478->86462 86478->86463 86478->86476 86483 40a053 86478->86483 86713 45ee98 74 API calls 86478->86713 86714 4019e0 75 API calls 86478->86714 86715 404260 75 API calls 86478->86715 86716 409210 VariantClear 86478->86716 86479 42dfe9 VariantClear 86479->86492 86480 42df47 VariantClear 86480->86492 86482 40a7a2 86495 40a7ad 86482->86495 86725 40b800 VariantClear VariantClear 86482->86725 86483->86309 86484 40e380 VariantClear 86484->86492 86485->86482 86507 40a800 86485->86507 86698 40b800 VariantClear VariantClear 86485->86698 86488 41171a 74 API calls 86488->86492 86489 41171a 74 API calls 86494 42dd10 VariantInit VariantCopy 86489->86494 86490 40a8b0 86501 40a8c2 86490->86501 86727 40e380 VariantClear 86490->86727 86491 42e312 86493 42e337 VariantClear 86491->86493 86491->86501 86492->86461 86492->86474 86492->86475 86492->86477 86492->86479 86492->86480 86492->86484 86492->86488 86492->86489 86721 46e9cd 74 API calls 86492->86721 86722 409210 VariantClear 86492->86722 86723 44cc6c VariantClear 86492->86723 86493->86501 86494->86492 86497 42dd30 VariantClear 86494->86497 86496 40a7ee 86495->86496 86503 42e2a7 VariantClear 86495->86503 86495->86507 86496->86507 86726 40e380 VariantClear 86496->86726 86497->86492 86498 42e3b2 86504 42e3da VariantClear 86498->86504 86510 40a91a 86498->86510 86501->86498 86502 40a908 86501->86502 86502->86510 86728 40e380 VariantClear 86502->86728 86503->86507 86504->86510 86505 42e47f 86511 42e4a3 VariantClear 86505->86511 86516 40a957 86505->86516 86507->86490 86507->86491 86508 40a945 86508->86516 86729 40e380 VariantClear 86508->86729 86510->86505 86510->86508 86511->86516 86513 40aa22 86513->86309 86514 42e559 VariantClear 86514->86516 86516->86513 86516->86514 86730 40e380 VariantClear 86516->86730 86517->86273 86518->86304 86519->86304 86520->86304 86521->86304 86522->86304 86523->86304 86525 40412e 86524->86525 86526 4092c0 VariantClear 86525->86526 86527 404138 86526->86527 86527->86297 86528->86304 86529->86304 86530->86309 86531->86272 86532->86309 86533->86309 86534->86315 86535->86318 86536->86333 86537->86335 86538->86322 86539->86362 86540->86361 86541->86366 86542->86362 86543->86368 86544->86362 86545->86368 86546->86362 86547->86349 86548->86368 86549->86353 86550->86368 86551->86347 86552->86374 86554 4092c0 VariantClear 86553->86554 86555 40416e 86554->86555 86556 404120 VariantClear 86555->86556 86557 40419b 86556->86557 86563 40efe0 86557->86563 86571 4734b7 86557->86571 86558 4041c6 86558->86371 86558->86382 86561->86371 86562->86373 86564 40eff5 CreateFileW 86563->86564 86565 4299bf 86563->86565 86566 40f017 86564->86566 86565->86566 86567 4299c4 CreateFileW 86565->86567 86566->86558 86567->86566 86568 4299ea 86567->86568 86615 40e0d0 SetFilePointerEx SetFilePointerEx 86568->86615 86570 4299f5 86570->86566 86572 453063 110 API calls 86571->86572 86573 4734d7 86572->86573 86574 473545 86573->86574 86575 47350c 86573->86575 86616 463c42 86574->86616 86576 4092c0 VariantClear 86575->86576 86583 473514 86576->86583 86578 473558 86579 47355c 86578->86579 86588 473595 86578->86588 86580 4092c0 VariantClear 86579->86580 86590 473564 86580->86590 86581 473616 86629 463d7e 86581->86629 86583->86558 86584 473622 86586 473697 86584->86586 86587 47362c 86584->86587 86585 453063 110 API calls 86585->86588 86663 457838 86586->86663 86591 4092c0 VariantClear 86587->86591 86588->86581 86588->86585 86596 473655 86588->86596 86675 462f5a 86 API calls 86588->86675 86590->86558 86594 473634 86591->86594 86594->86558 86598 4092c0 VariantClear 86596->86598 86609 47365d 86598->86609 86599 4736b0 86676 45e62e 115 API calls 86599->86676 86600 4736c9 86677 40e7e0 75 API calls 86600->86677 86603 4736ba GetCurrentProcess TerminateProcess 86603->86600 86604 4736db 86611 4736ff 86604->86611 86678 40d030 75 API calls 86604->86678 86605 473731 86612 473744 FreeLibrary 86605->86612 86613 47374b 86605->86613 86607 4736f1 86679 46b945 133 API calls 86607->86679 86609->86558 86611->86605 86680 40d030 75 API calls 86611->86680 86681 46b945 133 API calls 86611->86681 86612->86613 86613->86558 86615->86570 86682 45335b 75 API calls 86616->86682 86618 463c5d 86683 442c52 79 API calls 86618->86683 86620 463c72 86622 40c060 74 API calls 86620->86622 86628 463cac 86620->86628 86623 463c8e 86622->86623 86684 4608ce 74 API calls 86623->86684 86625 463ca4 86626 40c740 74 API calls 86625->86626 86626->86628 86627 463cf7 86627->86578 86628->86627 86685 462f5a 86 API calls 86628->86685 86630 453063 110 API calls 86629->86630 86631 463d99 86630->86631 86632 463de0 86631->86632 86633 463dca 86631->86633 86687 40c760 77 API calls 86632->86687 86686 453081 110 API calls 86633->86686 86636 463dd0 LoadLibraryW 86638 463e09 86636->86638 86637 463de7 86646 463e19 86637->86646 86688 40c760 77 API calls 86637->86688 86639 463e3e 86638->86639 86638->86646 86643 463e4e 86639->86643 86644 463e7b 86639->86644 86641 463dfb 86641->86646 86689 40c760 77 API calls 86641->86689 86690 40d500 74 API calls 86643->86690 86692 40c760 77 API calls 86644->86692 86646->86584 86648 463e82 GetProcAddress 86652 463e90 86648->86652 86649 463e57 86691 45efe7 76 API calls 86649->86691 86651 463e62 GetProcAddress 86654 463e79 86651->86654 86652->86646 86653 463edf 86652->86653 86652->86654 86653->86646 86656 463eef FreeLibrary 86653->86656 86654->86652 86693 403470 74 API calls 86654->86693 86656->86646 86657 463eb4 86694 40d500 74 API calls 86657->86694 86659 463ebd 86695 45efe7 76 API calls 86659->86695 86661 463ec8 GetProcAddress 86696 401330 86661->86696 86664 457a4c 86663->86664 86666 45785f 86663->86666 86671 410d40 86664->86671 86665 443576 77 API calls 86665->86666 86666->86664 86666->86665 86667 40c760 77 API calls 86666->86667 86668 4138ba 66 API calls 86666->86668 86669 453081 110 API calls 86666->86669 86670 40f580 76 API calls 86666->86670 86667->86666 86668->86666 86669->86666 86670->86666 86672 410d55 86671->86672 86673 410ded VirtualProtect 86672->86673 86674 410dbb 86672->86674 86673->86674 86674->86599 86674->86600 86675->86588 86676->86603 86677->86604 86678->86607 86679->86611 86680->86611 86681->86611 86682->86618 86683->86620 86684->86625 86685->86627 86686->86636 86687->86637 86688->86641 86689->86638 86690->86649 86691->86651 86692->86648 86693->86657 86694->86659 86695->86661 86696->86653 86697->86392 86698->86482 86699->86400 86700->86405 86701->86447 86702->86447 86703->86513 86704->86447 86705->86447 86706->86424 86707->86439 86708->86445 86709->86415 86710->86419 86711->86425 86712->86478 86713->86478 86714->86478 86715->86478 86716->86478 86717->86441 86718->86454 86719->86450 86720->86469 86721->86492 86722->86492 86723->86492 86724->86482 86725->86495 86726->86507 86727->86501 86728->86510 86729->86516 86730->86516 86731->86454 86732->86410 86733 42919b 86738 40ef10 86733->86738 86736 411421 73 API calls 86737 4291aa 86736->86737 86739 41171a 74 API calls 86738->86739 86740 40ef17 86739->86740 86741 42ad48 86740->86741 86746 40ef40 73 API calls 86740->86746 86743 40ef2a 86747 40e470 86743->86747 86746->86743 86748 40c060 74 API calls 86747->86748 86749 40e483 GetVersionExW 86748->86749 86750 4021e0 74 API calls 86749->86750 86751 40e4bb 86750->86751 86773 40e600 86751->86773 86757 42accc 86759 42ad28 GetSystemInfo 86757->86759 86762 42ad38 GetSystemInfo 86759->86762 86760 40e557 GetCurrentProcess 86793 40ee30 LoadLibraryA GetProcAddress 86760->86793 86761 40e56c 86761->86762 86786 40eee0 86761->86786 86766 40e5c9 86790 40eea0 86766->86790 86769 40e5e0 86771 40e5f1 FreeLibrary 86769->86771 86772 40e5f4 86769->86772 86770 40e5dd FreeLibrary 86770->86769 86771->86772 86772->86736 86774 40e60b 86773->86774 86775 40c740 74 API calls 86774->86775 86776 40e4c2 86775->86776 86777 40e620 86776->86777 86778 40e62a 86777->86778 86779 42ac93 86778->86779 86780 40c740 74 API calls 86778->86780 86781 40e4ce 86780->86781 86781->86757 86782 40ee70 86781->86782 86783 40e551 86782->86783 86784 40ee76 LoadLibraryA 86782->86784 86783->86760 86783->86761 86784->86783 86785 40ee87 GetProcAddress 86784->86785 86785->86783 86787 40e5bf 86786->86787 86788 40eee6 LoadLibraryA 86786->86788 86787->86759 86787->86766 86788->86787 86789 40eef7 GetProcAddress 86788->86789 86789->86787 86794 40eec0 LoadLibraryA GetProcAddress 86790->86794 86792 40e5d3 GetNativeSystemInfo 86792->86769 86792->86770 86793->86761 86794->86792 86795 42e89e 86802 40c000 86795->86802 86797 42e8ac 86798 409a40 164 API calls 86797->86798 86799 42e8ca 86798->86799 86813 44b92e VariantClear 86799->86813 86801 42f3ae 86803 40c014 86802->86803 86804 40c007 86802->86804 86806 40c01a 86803->86806 86807 40c02c 86803->86807 86814 409210 VariantClear 86804->86814 86815 409210 VariantClear 86806->86815 86808 41171a 74 API calls 86807->86808 86812 40c033 86808->86812 86809 40c00f 86809->86797 86811 40c023 86811->86797 86812->86797 86813->86801 86814->86809 86815->86811 86816 45644a8 86817 45620f8 GetPEB 86816->86817 86818 4564590 86817->86818 86830 4564398 86818->86830 86820 45645b9 CreateFileW 86822 456460d 86820->86822 86825 4564608 86820->86825 86823 4564624 VirtualAlloc 86822->86823 86822->86825 86824 4564642 ReadFile 86823->86824 86823->86825 86824->86825 86826 456465d 86824->86826 86827 4563398 13 API calls 86826->86827 86828 4564690 86827->86828 86829 45646b3 ExitProcess 86828->86829 86829->86825 86831 45643a1 Sleep 86830->86831 86832 45643af 86831->86832

                                                                                                                                                                          Executed Functions

                                                                                                                                                                          Function 00409A40 Relevance: 30.4, APIs: 14, Strings: 2, Instructions: 2432COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: BuffCharUpper
                                                                                                                                                                          • String ID: 0vH$4RH
                                                                                                                                                                          • API String ID: 3964851224-2085553193
                                                                                                                                                                          • Opcode ID: 46287a7bb28814e7acc9e24331a329a483cab8fdfa0313037193f1b97064f243
                                                                                                                                                                          • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
                                                                                                                                                                          • Opcode Fuzzy Hash: 46287a7bb28814e7acc9e24331a329a483cab8fdfa0313037193f1b97064f243
                                                                                                                                                                          • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B
                                                                                                                                                                          Function 0040E470 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 165COMMON
                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                          • Executed
                                                                                                                                                                          • Not Executed
                                                                                                                                                                          control_flow_graph 1124 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 1133 40e506-40e509 1124->1133 1134 42accc-42acd1 1124->1134 1137 40e540-40e555 call 40ee70 1133->1137 1138 40e50b-40e51c 1133->1138 1135 42acd3-42acdb 1134->1135 1136 42acdd-42ace0 1134->1136 1139 42ad12-42ad20 1135->1139 1140 42ace2-42aceb 1136->1140 1141 42aced-42acf0 1136->1141 1155 40e557-40e573 GetCurrentProcess call 40ee30 1137->1155 1156 40e579-40e5a8 1137->1156 1142 40e522-40e525 1138->1142 1143 42ac9b-42aca7 1138->1143 1154 42ad28-42ad2d GetSystemInfo 1139->1154 1140->1139 1141->1139 1145 42acf2-42ad06 1141->1145 1142->1137 1146 40e527-40e537 1142->1146 1148 42acb2-42acba 1143->1148 1149 42aca9-42acad 1143->1149 1150 42ad08-42ad0c 1145->1150 1151 42ad0e 1145->1151 1152 42acbf-42acc7 1146->1152 1153 40e53d 1146->1153 1148->1137 1149->1137 1150->1139 1151->1139 1152->1137 1153->1137 1157 42ad38-42ad3d GetSystemInfo 1154->1157 1155->1156 1165 40e575 1155->1165 1156->1157 1158 40e5ae-40e5c3 call 40eee0 1156->1158 1158->1154 1164 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 1158->1164 1168 40e5e0-40e5ef 1164->1168 1169 40e5dd-40e5de FreeLibrary 1164->1169 1165->1156 1170 40e5f1-40e5f2 FreeLibrary 1168->1170 1171 40e5f4-40e5ff 1168->1171 1169->1168 1170->1171
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetVersionExW.KERNEL32 ref: 0040E495
                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
                                                                                                                                                                          • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
                                                                                                                                                                          • FreeLibrary.KERNEL32(?), ref: 0040E5DE
                                                                                                                                                                          • FreeLibrary.KERNEL32(?), ref: 0040E5F2
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion
                                                                                                                                                                          • String ID: pMH
                                                                                                                                                                          • API String ID: 3079510601-2522892712
                                                                                                                                                                          • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                                                                                          • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
                                                                                                                                                                          • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                                                                                          • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
                                                                                                                                                                          Function 0040EB70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                          • Executed
                                                                                                                                                                          • Not Executed
                                                                                                                                                                          control_flow_graph 1710 40eb70-40eb74 1711 40eb96 1710->1711 1712 40eb76-40eb85 LoadLibraryA 1710->1712 1712->1711 1713 40eb87-40eb93 GetProcAddress 1712->1713 1713->1711
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                          • String ID: IsThemeActive$uxtheme.dll
                                                                                                                                                                          • API String ID: 2574300362-3542929980
                                                                                                                                                                          • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                                                                                          • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
                                                                                                                                                                          • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                                                                                          • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28
                                                                                                                                                                          Function 004095C7 Relevance: 21.5, APIs: 14, Instructions: 539sleeptimeCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 00409A40: CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                          • Sleep.KERNEL32(0000000A), ref: 00409870
                                                                                                                                                                          • timeGetTime.WINMM ref: 00409880
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: BuffCharSleepTimeUppertime
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2141449944-0
                                                                                                                                                                          • Opcode ID: da6b74c52f7fd8fa7285d44dc66266380a963bd06260c315e722df216112258b
                                                                                                                                                                          • Instruction ID: 79dfb759edd1749a95aa3438e3198289cebfc990e9c1b7da565b255c5aac8c6d
                                                                                                                                                                          • Opcode Fuzzy Hash: da6b74c52f7fd8fa7285d44dc66266380a963bd06260c315e722df216112258b
                                                                                                                                                                          • Instruction Fuzzy Hash: D422F171608342ABC724DF64C984BABB7A0BF89304F14492FE54997392D77CEC45CB9A
                                                                                                                                                                          Function 004102F0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                          APIs
                                                                                                                                                                          • GetSysColorBrush.USER32 ref: 00410326
                                                                                                                                                                          • RegisterClassExW.USER32 ref: 00410359
                                                                                                                                                                          • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                                                                                          • InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                                                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                                                                                          • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                                                                                          • ImageList_ReplaceIcon.COMCTL32(00A9F990,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                                                                                          • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                                                                                                          • API String ID: 2914291525-1005189915
                                                                                                                                                                          • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                                                                                          • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
                                                                                                                                                                          • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                                                                                          • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A
                                                                                                                                                                          Function 004101F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74windowregistryCOMMON
                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                          APIs
                                                                                                                                                                          • GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                                                                                          • LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                                                                                          • LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                                                                                          • LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                                                                                          • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                                                                                          • RegisterClassExW.USER32 ref: 004102C6
                                                                                                                                                                            • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
                                                                                                                                                                            • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
                                                                                                                                                                            • Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                                                                                            • Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                                                                                            • Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                                                                                            • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                                                                                            • Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(00A9F990,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                                                                                          • String ID: #$0$PGH
                                                                                                                                                                          • API String ID: 423443420-3673556320
                                                                                                                                                                          • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                                                                                          • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
                                                                                                                                                                          • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                                                                                          • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99
                                                                                                                                                                          Function 004255C4 Relevance: 14.1, APIs: 9, Instructions: 579fileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CreateFileW.KERNELBASE(00000080,00000000,00000080,0000000C,00000001,00000080,00000000,00000109,00000000,00000109), ref: 004257F3
                                                                                                                                                                          • CreateFileW.KERNEL32(00000080,7FFFFFFF,00000001,0000000C,00000001,00000080,00000000), ref: 0042582C
                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00425851
                                                                                                                                                                          • GetFileType.KERNELBASE(?), ref: 0042586D
                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00425892
                                                                                                                                                                          • CloseHandle.KERNEL32(?), ref: 004258A4
                                                                                                                                                                          • CloseHandle.KERNEL32(?), ref: 00425C6A
                                                                                                                                                                          • CreateFileW.KERNEL32(00000080,00000000,00000001,0000000C,00000003,00000080,00000000), ref: 00425C87
                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00425C92
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: File$CreateErrorLast$CloseHandle$Type
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 352418905-0
                                                                                                                                                                          • Opcode ID: 9a2842c33dd42d113f273929bf8fd8cb84c1a2513e7f56b17b889415b9c929d6
                                                                                                                                                                          • Instruction ID: 669c70fe02d08c48a4bfc23b5c295140071241b72d0cac454048e7f20503c7df
                                                                                                                                                                          • Opcode Fuzzy Hash: 9a2842c33dd42d113f273929bf8fd8cb84c1a2513e7f56b17b889415b9c929d6
                                                                                                                                                                          • Instruction Fuzzy Hash: DF222371A00A299BDF219F68E8857AE7BB1EF01314FA4066AE451D7391D33D8D80CB59
                                                                                                                                                                          Function 0041E7DC Relevance: 12.5, APIs: 8, Instructions: 520COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: ec6185bb95033948424997075615cd394999d7b3352a51c3c84c5f176d9edcdf
                                                                                                                                                                          • Instruction ID: 60237bb9b030d907ca0bd1bf58dcbb3909e656aee1947051e473b0785f795cf0
                                                                                                                                                                          • Opcode Fuzzy Hash: ec6185bb95033948424997075615cd394999d7b3352a51c3c84c5f176d9edcdf
                                                                                                                                                                          • Instruction Fuzzy Hash: E112A4789042869FDB21DF6AC8847EA7BF0BF06304F14459FED6287292D37899C1CB59
                                                                                                                                                                          Function 00410B90 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 167registryCOMMON
                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                          • Executed
                                                                                                                                                                          • Not Executed
                                                                                                                                                                          control_flow_graph 1555 410b90-410cf1 call 425210 call 41171a GetModuleFileNameW call 413db0 call 413dfc call 413e3c call 41171a call 411691 RegOpenKeyExW 1570 429bc3-429bec RegQueryValueExW 1555->1570 1571 410cf7-410d03 1555->1571 1572 429bf2-429c18 1570->1572 1573 429cd9-429cde RegCloseKey 1570->1573 1574 429c1f-429c31 1572->1574 1575 429c33-429c37 1574->1575 1576 429c50-429c5f call 4112d5 1574->1576 1575->1576 1577 429c39-429c48 call 411663 1575->1577 1582 429c61-429c74 call 4112d5 1576->1582 1583 429c88-429cd2 call 41171a call 41326a 1576->1583 1586 429c4b-429c4e 1577->1586 1582->1583 1589 429c76-429c85 call 411663 1582->1589 1583->1586 1594 429cd8 1583->1594 1586->1574 1589->1583 1594->1573
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
                                                                                                                                                                          • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
                                                                                                                                                                          • RegQueryValueExW.ADVAPI32 ref: 00429BE4
                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 00429CDE
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CloseFileModuleNameOpenQueryValue
                                                                                                                                                                          • String ID: Include$Software\AutoIt v3\AutoIt$\
                                                                                                                                                                          • API String ID: 3617018055-2276155026
                                                                                                                                                                          • Opcode ID: d7f6643cad26fd3001d91627fc5ef1af4f656d40d4c5ca14c02d7ab544e78cf5
                                                                                                                                                                          • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
                                                                                                                                                                          • Opcode Fuzzy Hash: d7f6643cad26fd3001d91627fc5ef1af4f656d40d4c5ca14c02d7ab544e78cf5
                                                                                                                                                                          • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A
                                                                                                                                                                          Function 04564708 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                          • Executed
                                                                                                                                                                          • Not Executed
                                                                                                                                                                          control_flow_graph 1595 4564708-45647b6 call 45620f8 1598 45647bd-45647e3 call 4565618 CreateFileW 1595->1598 1601 45647e5 1598->1601 1602 45647ea-45647fa 1598->1602 1603 4564935-4564939 1601->1603 1610 4564801-456481b VirtualAlloc 1602->1610 1611 45647fc 1602->1611 1604 456497b-456497e 1603->1604 1605 456493b-456493f 1603->1605 1607 4564981-4564988 1604->1607 1608 4564941-4564944 1605->1608 1609 456494b-456494f 1605->1609 1612 45649dd-45649f2 1607->1612 1613 456498a-4564995 1607->1613 1608->1609 1614 4564951-456495b 1609->1614 1615 456495f-4564963 1609->1615 1616 4564822-4564839 ReadFile 1610->1616 1617 456481d 1610->1617 1611->1603 1622 45649f4-45649ff VirtualFree 1612->1622 1623 4564a02-4564a0a 1612->1623 1620 4564997 1613->1620 1621 4564999-45649a5 1613->1621 1614->1615 1624 4564965-456496f 1615->1624 1625 4564973 1615->1625 1618 4564840-4564880 VirtualAlloc 1616->1618 1619 456483b 1616->1619 1617->1603 1626 4564887-45648a2 call 4565868 1618->1626 1627 4564882 1618->1627 1619->1603 1620->1612 1628 45649a7-45649b7 1621->1628 1629 45649b9-45649c5 1621->1629 1622->1623 1624->1625 1625->1604 1635 45648ad-45648b7 1626->1635 1627->1603 1631 45649db 1628->1631 1632 45649c7-45649d0 1629->1632 1633 45649d2-45649d8 1629->1633 1631->1607 1632->1631 1633->1631 1636 45648ea-45648fe call 4565678 1635->1636 1637 45648b9-45648e8 call 4565868 1635->1637 1643 4564902-4564906 1636->1643 1644 4564900 1636->1644 1637->1635 1645 4564912-4564916 1643->1645 1646 4564908-456490c CloseHandle 1643->1646 1644->1603 1647 4564926-456492f 1645->1647 1648 4564918-4564923 VirtualFree 1645->1648 1646->1645 1647->1598 1647->1603 1648->1647
                                                                                                                                                                          APIs
                                                                                                                                                                          • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 045647D9
                                                                                                                                                                          • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 045649FF
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2482082103.0000000004562000.00000040.00000020.00020000.00000000.sdmp, Offset: 04562000, based on PE: false
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_4562000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CreateFileFreeVirtual
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 204039940-0
                                                                                                                                                                          • Opcode ID: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
                                                                                                                                                                          • Instruction ID: 750309e118ca6eefb4f1a6e4f6be18861499fa2e9e83e51b022a27d9cc53ba82
                                                                                                                                                                          • Opcode Fuzzy Hash: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
                                                                                                                                                                          • Instruction Fuzzy Hash: 72A13870E40209EBDB14CFA4D894BEEBBB5FF49704F208559E106BB280D775AA81EF54
                                                                                                                                                                          Function 00401230 Relevance: 10.6, APIs: 7, Instructions: 83windowtimeCOMMON
                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                          • Executed
                                                                                                                                                                          • Not Executed
                                                                                                                                                                          control_flow_graph 1649 401230-40123b 1650 401241-401272 call 4131f0 call 401be0 1649->1650 1651 4012c5-4012cd 1649->1651 1656 401274-401292 1650->1656 1657 4012ae-4012bf KillTimer SetTimer 1650->1657 1658 42aa61-42aa67 1656->1658 1659 401298-40129c 1656->1659 1657->1651 1662 42aa8b-42aaa7 Shell_NotifyIconW 1658->1662 1663 42aa69-42aa86 Shell_NotifyIconW 1658->1663 1660 4012a2-4012a8 1659->1660 1661 42aaac-42aab3 1659->1661 1660->1657 1666 42aaf8-42ab15 Shell_NotifyIconW 1660->1666 1664 42aad7-42aaf3 Shell_NotifyIconW 1661->1664 1665 42aab5-42aad2 Shell_NotifyIconW 1661->1665 1662->1657 1663->1657 1664->1657 1665->1657 1666->1657
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                                                                                          • KillTimer.USER32(?,?), ref: 004012B0
                                                                                                                                                                          • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
                                                                                                                                                                          • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
                                                                                                                                                                          • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
                                                                                                                                                                          • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: IconNotifyShell_$Timer$Kill
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3970887597-0
                                                                                                                                                                          • Opcode ID: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                                                                                          • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
                                                                                                                                                                          • Opcode Fuzzy Hash: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                                                                                          • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB
                                                                                                                                                                          Function 004103E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                          • Executed
                                                                                                                                                                          • Not Executed
                                                                                                                                                                          control_flow_graph 1667 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
                                                                                                                                                                          APIs
                                                                                                                                                                          • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                                                                                          • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                                                                                          • ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                                                                                          • ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$CreateShow
                                                                                                                                                                          • String ID: AutoIt v3$edit
                                                                                                                                                                          • API String ID: 1584632944-3779509399
                                                                                                                                                                          • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                                                                                          • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
                                                                                                                                                                          • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                                                                                          • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C
                                                                                                                                                                          Function 045644A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155fileCOMMON
                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                          • Executed
                                                                                                                                                                          • Not Executed
                                                                                                                                                                          control_flow_graph 1668 45644a8-4564606 call 45620f8 call 4564398 CreateFileW 1675 456460d-456461d 1668->1675 1676 4564608 1668->1676 1679 4564624-456463e VirtualAlloc 1675->1679 1680 456461f 1675->1680 1677 45646bd-45646c2 1676->1677 1681 4564642-4564659 ReadFile 1679->1681 1682 4564640 1679->1682 1680->1677 1683 456465d-4564697 call 45643d8 call 4563398 1681->1683 1684 456465b 1681->1684 1682->1677 1689 45646b3-45646bb ExitProcess 1683->1689 1690 4564699-45646ae call 4564428 1683->1690 1684->1677 1689->1677 1690->1689
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 04564398: Sleep.KERNELBASE(000001F4), ref: 045643A9
                                                                                                                                                                          • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 045645FC
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2482082103.0000000004562000.00000040.00000020.00020000.00000000.sdmp, Offset: 04562000, based on PE: false
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_4562000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CreateFileSleep
                                                                                                                                                                          • String ID: PDHYITHPOHQ1W
                                                                                                                                                                          • API String ID: 2694422964-503966709
                                                                                                                                                                          • Opcode ID: c966acf5050b519332ca96fcdcdf7e96d4952729b123506abb7bb3371feab4a3
                                                                                                                                                                          • Instruction ID: 2dce11f7324e1648c2197e4c93d6ad0ba58a9da3d18efe1630d8ff4d9b7ccd7c
                                                                                                                                                                          • Opcode Fuzzy Hash: c966acf5050b519332ca96fcdcdf7e96d4952729b123506abb7bb3371feab4a3
                                                                                                                                                                          • Instruction Fuzzy Hash: FC51A030E04248EBEF10DBA4D844BEEBB75EF59704F004598E619BB2C0D7BA1A45CB69
                                                                                                                                                                          Function 00410130 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                          • Executed
                                                                                                                                                                          • Not Executed
                                                                                                                                                                          control_flow_graph 1692 410130-410142 SHGetMalloc 1693 410148-410158 SHGetDesktopFolder 1692->1693 1694 42944f-429459 call 411691 1692->1694 1695 4101d1-4101e0 1693->1695 1696 41015a-410188 call 411691 1693->1696 1695->1694 1702 4101e6-4101ee 1695->1702 1704 4101c5-4101ce 1696->1704 1705 41018a-4101a1 SHGetPathFromIDListW 1696->1705 1704->1695 1706 4101a3-4101b1 call 411691 1705->1706 1707 4101b4-4101c0 1705->1707 1706->1707 1707->1704
                                                                                                                                                                          APIs
                                                                                                                                                                          • SHGetMalloc.SHELL32(00000000), ref: 0041013A
                                                                                                                                                                          • SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                                                                                                                                                                          • SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: DesktopFolderFromListMallocPath
                                                                                                                                                                          • String ID: C:\Users\user\Desktop\Purchase Order.exe
                                                                                                                                                                          • API String ID: 2281215042-1665358040
                                                                                                                                                                          • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                                                                                          • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
                                                                                                                                                                          • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                                                                                          • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6
                                                                                                                                                                          Function 04563398 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                          • Executed
                                                                                                                                                                          • Not Executed
                                                                                                                                                                          control_flow_graph 1714 4563398-4563438 call 4565848 * 3 1721 456344f 1714->1721 1722 456343a-4563444 1714->1722 1723 4563456-456345f 1721->1723 1722->1721 1724 4563446-456344d 1722->1724 1725 4563466-4563b18 1723->1725 1724->1723 1726 4563b1a-4563b1e 1725->1726 1727 4563b2b-4563b58 CreateProcessW 1725->1727 1728 4563b64-4563b91 1726->1728 1729 4563b20-4563b24 1726->1729 1734 4563b62 1727->1734 1735 4563b5a-4563b5d 1727->1735 1745 4563b93-4563b96 1728->1745 1746 4563b9b 1728->1746 1731 4563b26 1729->1731 1732 4563b9d-4563bca 1729->1732 1733 4563bd4-4563bee Wow64GetThreadContext 1731->1733 1732->1733 1755 4563bcc-4563bcf 1732->1755 1737 4563bf5-4563c10 ReadProcessMemory 1733->1737 1738 4563bf0 1733->1738 1734->1733 1740 4563f59-4563f5b 1735->1740 1742 4563c17-4563c20 1737->1742 1743 4563c12 1737->1743 1741 4563f02-4563f06 1738->1741 1747 4563f57 1741->1747 1748 4563f08-4563f0c 1741->1748 1750 4563c22-4563c31 1742->1750 1751 4563c49-4563c68 call 4564ec8 1742->1751 1743->1741 1745->1740 1746->1733 1747->1740 1753 4563f21-4563f25 1748->1753 1754 4563f0e-4563f1a 1748->1754 1750->1751 1756 4563c33-4563c42 call 4564e18 1750->1756 1761 4563c6f-4563c92 call 4565008 1751->1761 1762 4563c6a 1751->1762 1758 4563f27-4563f2a 1753->1758 1759 4563f31-4563f35 1753->1759 1754->1753 1755->1733 1755->1740 1756->1751 1767 4563c44 1756->1767 1758->1759 1764 4563f37-4563f3a 1759->1764 1765 4563f41-4563f45 1759->1765 1773 4563c94-4563c9b 1761->1773 1774 4563cdc-4563cfd call 4565008 1761->1774 1762->1741 1764->1765 1769 4563f47-4563f4d call 4564e18 1765->1769 1770 4563f52-4563f55 1765->1770 1767->1741 1769->1770 1770->1740 1776 4563cd7 1773->1776 1777 4563c9d-4563cc7 call 4565008 1773->1777 1780 4563d04-4563d22 call 4565868 1774->1780 1781 4563cff 1774->1781 1776->1741 1782 4563ccc-4563cce 1777->1782 1787 4563d2d-4563d37 1780->1787 1781->1741 1784 4563cd5 1782->1784 1785 4563cd0 1782->1785 1784->1774 1785->1741 1788 4563d6d-4563d71 1787->1788 1789 4563d39-4563d6b call 4565868 1787->1789 1791 4563d77-4563d87 1788->1791 1792 4563e5c-4563e79 call 4564a18 1788->1792 1789->1787 1791->1792 1795 4563d8d-4563d9d 1791->1795 1799 4563e80-4563e9f Wow64SetThreadContext 1792->1799 1800 4563e7b 1792->1800 1795->1792 1798 4563da3-4563dc7 1795->1798 1801 4563dca-4563dce 1798->1801 1803 4563ea3-4563eae call 4564d48 1799->1803 1804 4563ea1 1799->1804 1800->1741 1801->1792 1802 4563dd4-4563de9 1801->1802 1805 4563dfd-4563e01 1802->1805 1810 4563eb2-4563eb6 1803->1810 1811 4563eb0 1803->1811 1804->1741 1807 4563e03-4563e0f 1805->1807 1808 4563e3f-4563e57 1805->1808 1812 4563e11-4563e3b 1807->1812 1813 4563e3d 1807->1813 1808->1801 1814 4563ec2-4563ec6 1810->1814 1815 4563eb8-4563ebb 1810->1815 1811->1741 1812->1813 1813->1805 1817 4563ed2-4563ed6 1814->1817 1818 4563ec8-4563ecb 1814->1818 1815->1814 1819 4563ee2-4563ee6 1817->1819 1820 4563ed8-4563edb 1817->1820 1818->1817 1821 4563ef3-4563efc 1819->1821 1822 4563ee8-4563eee call 4564e18 1819->1822 1820->1819 1821->1725 1821->1741 1822->1821
                                                                                                                                                                          APIs
                                                                                                                                                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 04563B53
                                                                                                                                                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 04563BE9
                                                                                                                                                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 04563C0B
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2482082103.0000000004562000.00000040.00000020.00020000.00000000.sdmp, Offset: 04562000, based on PE: false
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_4562000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2438371351-0
                                                                                                                                                                          • Opcode ID: 51a3eba446a9bbb1a9416ea03989c14c5a1c3a2d5be52081b7aa0183c4e9d3fa
                                                                                                                                                                          • Instruction ID: 551eee58a8f00ad1b668b2e25f0a63dadef993139d5bb0add542d70356028b1c
                                                                                                                                                                          • Opcode Fuzzy Hash: 51a3eba446a9bbb1a9416ea03989c14c5a1c3a2d5be52081b7aa0183c4e9d3fa
                                                                                                                                                                          • Instruction Fuzzy Hash: A8620C30A142189BEB24CFA4D850BDEB376FF58300F1095A9D50DEB390E77A9E81DB59
                                                                                                                                                                          Function 004734B7 Relevance: 4.7, APIs: 3, Instructions: 234COMMON
                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                                                                                          • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
                                                                                                                                                                          • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                                                                                          • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
                                                                                                                                                                          Function 0040F110 Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                          • Executed
                                                                                                                                                                          • Not Executed
                                                                                                                                                                          control_flow_graph 1987 40f110-40f13a RegOpenKeyExW 1988 40f13c-40f159 RegQueryValueExW RegCloseKey 1987->1988 1989 40f15f-40f160 1987->1989 1988->1989
                                                                                                                                                                          APIs
                                                                                                                                                                          • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
                                                                                                                                                                          • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
                                                                                                                                                                          • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CloseOpenQueryValue
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3677997916-0
                                                                                                                                                                          • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                                                                                          • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
                                                                                                                                                                          • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                                                                                          • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
                                                                                                                                                                          Function 0040B380 Relevance: 3.3, APIs: 2, Instructions: 255COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ClearVariant
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1473721057-0
                                                                                                                                                                          • Opcode ID: 4e47f038e922e84c19ecab33a0164ae102939a21ade882e67390b57c38244a2e
                                                                                                                                                                          • Instruction ID: 1f11e118333250ff1b1cce483c812f274274124743f71e781b8a547d9d3e43da
                                                                                                                                                                          • Opcode Fuzzy Hash: 4e47f038e922e84c19ecab33a0164ae102939a21ade882e67390b57c38244a2e
                                                                                                                                                                          • Instruction Fuzzy Hash: 35917E706042009FC714DF55D890A6AB7E5EF89318F14896FF849AB392D738EE41CB9E
                                                                                                                                                                          Function 00416193 Relevance: 3.1, APIs: 2, Instructions: 100COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetStartupInfoW.KERNEL32(?,0048C920,00000058), ref: 004161A8
                                                                                                                                                                          • GetCommandLineW.KERNEL32 ref: 0041623D
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CommandInfoLineStartup
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 582193876-0
                                                                                                                                                                          • Opcode ID: 0ff05a0656d0cabc76cd69936c9fb6d5f070ff973f57c73f94411b1fd4ca271d
                                                                                                                                                                          • Instruction ID: 4cece88e8d20870e626e2a15fe4d62767af7f5e44e91f32af7e3c33ec5ed94b3
                                                                                                                                                                          • Opcode Fuzzy Hash: 0ff05a0656d0cabc76cd69936c9fb6d5f070ff973f57c73f94411b1fd4ca271d
                                                                                                                                                                          • Instruction Fuzzy Hash: 5A31B771E40314E9DB10BBB2A9467EE2664AF1070CF1144AFF915AA2D3DBBCC9C18B5D
                                                                                                                                                                          Function 0040EFE0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
                                                                                                                                                                          • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CreateFile
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 823142352-0
                                                                                                                                                                          • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                                                                                          • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
                                                                                                                                                                          • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                                                                                          • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
                                                                                                                                                                          Function 0041EF5F Relevance: 3.0, APIs: 2, Instructions: 45COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SetFilePointer.KERNELBASE(00000000,00000109,00000000,00425BA7,00074000,00000109,?,00425BA7,00000109,00000000,00000000), ref: 0041EF8E
                                                                                                                                                                          • GetLastError.KERNEL32(?,00425BA7,00000109,00000000,00000000), ref: 0041EF9B
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ErrorFileLastPointer
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2976181284-0
                                                                                                                                                                          • Opcode ID: d0e113ae251f39dc1295bd3d0d5c570924977ae37561d63c63e682e8777c236f
                                                                                                                                                                          • Instruction ID: cf4b6fdaa65d58340d4e2f426219068bfe2c256bea3d67c41a1efc08f55daa7f
                                                                                                                                                                          • Opcode Fuzzy Hash: d0e113ae251f39dc1295bd3d0d5c570924977ae37561d63c63e682e8777c236f
                                                                                                                                                                          • Instruction Fuzzy Hash: 4401F4366145147BCA115BBAAC089DA3B699F82334B250726FE34CF1D1CB78C88297A9
                                                                                                                                                                          Function 00413A88 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                                                                                          • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                                                                                            • Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CriticalEnterErrorFreeHeapLastSection
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2972400715-0
                                                                                                                                                                          • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                                                                                          • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
                                                                                                                                                                          • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                                                                                          • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
                                                                                                                                                                          Function 004098B8 Relevance: 3.0, APIs: 2, Instructions: 32windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                                                                                          • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Message$DispatchTranslate
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1706434739-0
                                                                                                                                                                          • Opcode ID: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                                                                                          • Instruction ID: 6b3a2aeb923af73eb4cdb1bab797699f2cf27729a5018e8568c19fb4e3feaf67
                                                                                                                                                                          • Opcode Fuzzy Hash: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                                                                                          • Instruction Fuzzy Hash: D4F05471114301AEDA24DBE58D41B5BB3A8AFD8700F408C2EBA51E61C1FBF8E404C76A
                                                                                                                                                                          Function 004098B6 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                                                                                          • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Message$DispatchTranslate
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1706434739-0
                                                                                                                                                                          • Opcode ID: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                                                                                          • Instruction ID: cc4909b6a78c34842ee59a7900970f574117f06624f4f9c7373c79b1fb9dfc76
                                                                                                                                                                          • Opcode Fuzzy Hash: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                                                                                          • Instruction Fuzzy Hash: DDF054B1114301AADA14DBE58D41B5BB3A4AF94740F408C2EBA11E52C1EBFCD504C71A
                                                                                                                                                                          Function 0041E517 Relevance: 2.6, APIs: 2, Instructions: 61COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CloseHandle.KERNELBASE(00000000,00000000,00000109,?,0042595E,00000109), ref: 0041E569
                                                                                                                                                                          • GetLastError.KERNEL32(?,0042595E,00000109), ref: 0041E573
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CloseErrorHandleLast
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 918212764-0
                                                                                                                                                                          • Opcode ID: bcac448e53919a337955079ba1fb01489cacc7633263b2fdf1f383f96fd6d644
                                                                                                                                                                          • Instruction ID: 19e2beeb38f2cf2c4278f884dded42d16dad9246bf5dd3ae84917a532f316d83
                                                                                                                                                                          • Opcode Fuzzy Hash: bcac448e53919a337955079ba1fb01489cacc7633263b2fdf1f383f96fd6d644
                                                                                                                                                                          • Instruction Fuzzy Hash: 34010C3691512035C61162BA5905BEB26868F8273CF59011BFD18873D2FB6DCCC2829D
                                                                                                                                                                          Function 04563395 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 04563B53
                                                                                                                                                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 04563BE9
                                                                                                                                                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 04563C0B
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2482082103.0000000004562000.00000040.00000020.00020000.00000000.sdmp, Offset: 04562000, based on PE: false
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_4562000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2438371351-0
                                                                                                                                                                          • Opcode ID: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
                                                                                                                                                                          • Instruction ID: 18976f6d1aa6014eeb7895acc6deff9730aeeb5bf8a3972cb359ba2e1b7aaceb
                                                                                                                                                                          • Opcode Fuzzy Hash: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
                                                                                                                                                                          • Instruction Fuzzy Hash: 5C12DE20E24658C6EB24DF64D8507DEB232FF68300F1094E9910DEB7A5E77A5E81CF5A
                                                                                                                                                                          Function 00410D40 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ProtectVirtual
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 544645111-0
                                                                                                                                                                          • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                                          • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
                                                                                                                                                                          • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                                          • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
                                                                                                                                                                          Function 004138BA Relevance: 1.6, APIs: 1, Instructions: 77memoryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AllocateHeap
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1279760036-0
                                                                                                                                                                          • Opcode ID: 03b941ca31b2eefa3ee245af14a45a05522b7591dd32a7038f61ecb62e62ab21
                                                                                                                                                                          • Instruction ID: ed42b26ac187221e93853d6dfd9c7f51b54a687a62893bdaf2a19a7afcae2479
                                                                                                                                                                          • Opcode Fuzzy Hash: 03b941ca31b2eefa3ee245af14a45a05522b7591dd32a7038f61ecb62e62ab21
                                                                                                                                                                          • Instruction Fuzzy Hash: F91106B25156155ADA112F2ADC01BEB7798DF0136AF11013BF940AB2A0CBEC8EC186DC
                                                                                                                                                                          Function 004092C0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: 0d8ad4d875158e0120ed104e09085659f42b86f6d600f5d33fa38308f41241bf
                                                                                                                                                                          • Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
                                                                                                                                                                          • Opcode Fuzzy Hash: 0d8ad4d875158e0120ed104e09085659f42b86f6d600f5d33fa38308f41241bf
                                                                                                                                                                          • Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E
                                                                                                                                                                          Function 00401108 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ProcWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 181713994-0
                                                                                                                                                                          • Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                                                                                          • Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
                                                                                                                                                                          • Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                                                                                          • Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E
                                                                                                                                                                          Function 0041AA31 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CreateHeap
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 10892065-0
                                                                                                                                                                          • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                                                                                          • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
                                                                                                                                                                          • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                                                                                          • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
                                                                                                                                                                          Function 00444343 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
                                                                                                                                                                          • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: File$PointerWrite
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 539440098-0
                                                                                                                                                                          • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                                                                                          • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
                                                                                                                                                                          • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                                                                                          • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
                                                                                                                                                                          Function 0040116E Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ProcWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 181713994-0
                                                                                                                                                                          • Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                                                                                          • Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
                                                                                                                                                                          • Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                                                                                          • Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1
                                                                                                                                                                          Function 00416FB6 Relevance: 1.3, APIs: 1, Instructions: 28sleepCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                                                                                          • Sleep.KERNEL32(00000000,00000001,00411739,?,00418391,00000018,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00416FD7
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AllocateHeapSleep
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 4201116106-0
                                                                                                                                                                          • Opcode ID: 7351f003d9c4e269a066673786ffac8decad1e325cedd491f8ecc1fa6b0779cb
                                                                                                                                                                          • Instruction ID: 62b9039d0dc2d1652bd8483666354cb4007973faf85ac804ab3d87b56acb7484
                                                                                                                                                                          • Opcode Fuzzy Hash: 7351f003d9c4e269a066673786ffac8decad1e325cedd491f8ecc1fa6b0779cb
                                                                                                                                                                          • Instruction Fuzzy Hash: 6DE0923290051557CB206A7AF8488CB7F9ADA913B5322077BF538C2390DA25CD86829C
                                                                                                                                                                          Function 0040D900 Relevance: 1.3, APIs: 1, Instructions: 22COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CloseHandle
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2962429428-0
                                                                                                                                                                          • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                                                                                          • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
                                                                                                                                                                          • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                                                                                          • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
                                                                                                                                                                          Function 04564394 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • Sleep.KERNELBASE(000001F4), ref: 045643A9
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2482082103.0000000004562000.00000040.00000020.00020000.00000000.sdmp, Offset: 04562000, based on PE: false
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_4562000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Sleep
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3472027048-0
                                                                                                                                                                          • Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                                                                                                                                          • Instruction ID: 9c1f19719c70ff051d69978447192ae5dc43b0e3e1445edf7b58e62d15aec524
                                                                                                                                                                          • Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                                                                                                                                          • Instruction Fuzzy Hash: 0DE0BF7494010DEFDB00DFA8D5496DD7BB4FF04301F1006A1FD05D7680DB309E549A66
                                                                                                                                                                          Function 04564398 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • Sleep.KERNELBASE(000001F4), ref: 045643A9
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2482082103.0000000004562000.00000040.00000020.00020000.00000000.sdmp, Offset: 04562000, based on PE: false
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_4562000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Sleep
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3472027048-0
                                                                                                                                                                          • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                                                                          • Instruction ID: 9827e3545f8c6a342e6606947771a1a9d5f360b17a650f4fe6a77bdc7ddb772b
                                                                                                                                                                          • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                                                                          • Instruction Fuzzy Hash: EAE0E67494010DEFDB00DFB8D54969D7BB4FF04301F100661FD01D2280D6309D509A62

                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                          Function 0047C08E Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 676windowkeyboardCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
                                                                                                                                                                          • DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
                                                                                                                                                                          • GetKeyState.USER32(00000011), ref: 0047C1A4
                                                                                                                                                                          • GetKeyState.USER32(00000009), ref: 0047C1AD
                                                                                                                                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
                                                                                                                                                                          • GetKeyState.USER32(00000010), ref: 0047C1CA
                                                                                                                                                                          • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
                                                                                                                                                                          • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
                                                                                                                                                                          • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
                                                                                                                                                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
                                                                                                                                                                          • SendMessageW.USER32 ref: 0047C2FB
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$State$LongProcWindow
                                                                                                                                                                          • String ID: @GUI_DRAGID$F
                                                                                                                                                                          • API String ID: 1562745308-4164748364
                                                                                                                                                                          • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                                                                                          • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
                                                                                                                                                                          • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                                                                                          • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
                                                                                                                                                                          Function 004045E0 Relevance: 46.9, Strings: 35, Instructions: 3193COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID: PF$'|G$*"D$*vG$+%F$0wE$2G$5CG$7eF$<HF$<G$ApG$DvE$GSG$IqE$K@G$LbF$MdF$NgF$PIF$YtG$^[F$_?G$b"D$i}G$j)F$kQG$lE$rTG$vjE$}eE$*F$3G$_G$wG
                                                                                                                                                                          • API String ID: 0-3772701627
                                                                                                                                                                          • Opcode ID: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                                                                                          • Instruction ID: b1e67458769bbea4a86cd8903524db5b6e79558e2e7ab8c51025fc7bd56032a7
                                                                                                                                                                          • Opcode Fuzzy Hash: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                                                                                          • Instruction Fuzzy Hash: 118366F1905B409FC351DFAAF984605BAE1F3AA3157A2857FC5088B731D7B8194A8F4C
                                                                                                                                                                          Function 004375B0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 126threadkeyboardwindowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
                                                                                                                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
                                                                                                                                                                          • IsIconic.USER32(?), ref: 004375E1
                                                                                                                                                                          • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
                                                                                                                                                                          • SetForegroundWindow.USER32(?), ref: 004375FD
                                                                                                                                                                          • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00437619
                                                                                                                                                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
                                                                                                                                                                          • SetForegroundWindow.USER32(?), ref: 00437645
                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
                                                                                                                                                                          • keybd_event.USER32(00000012,00000000), ref: 0043765D
                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
                                                                                                                                                                          • keybd_event.USER32(00000012,00000000), ref: 00437674
                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
                                                                                                                                                                          • keybd_event.USER32(00000012,00000000), ref: 0043768B
                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
                                                                                                                                                                          • keybd_event.USER32(00000012,00000000), ref: 004376A2
                                                                                                                                                                          • SetForegroundWindow.USER32(?), ref: 004376AD
                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                                                                                          • String ID: Shell_TrayWnd
                                                                                                                                                                          • API String ID: 3778422247-2988720461
                                                                                                                                                                          • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                                                                                          • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
                                                                                                                                                                          • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                                                                                          • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
                                                                                                                                                                          Function 004461ED Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 227processCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
                                                                                                                                                                          • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
                                                                                                                                                                          • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
                                                                                                                                                                          • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
                                                                                                                                                                          • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
                                                                                                                                                                          • LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
                                                                                                                                                                          • CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
                                                                                                                                                                          • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
                                                                                                                                                                          • UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
                                                                                                                                                                          • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
                                                                                                                                                                          • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
                                                                                                                                                                          • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
                                                                                                                                                                          • DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload
                                                                                                                                                                          • String ID: $default$winsta0
                                                                                                                                                                          • API String ID: 4266742174-1027155976
                                                                                                                                                                          • Opcode ID: dd3fbc5dfca59238d4d8e810ac2ec3cbfbbbad9087bbfadb14fa7de528d26857
                                                                                                                                                                          • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
                                                                                                                                                                          • Opcode Fuzzy Hash: dd3fbc5dfca59238d4d8e810ac2ec3cbfbbbad9087bbfadb14fa7de528d26857
                                                                                                                                                                          • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
                                                                                                                                                                          Function 00464422 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 193threadCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
                                                                                                                                                                          • GetLastError.KERNEL32 ref: 004644B4
                                                                                                                                                                          • GetCurrentThread.KERNEL32 ref: 004644C8
                                                                                                                                                                          • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
                                                                                                                                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: OpenProcess$CurrentThreadToken$ErrorLast
                                                                                                                                                                          • String ID: SeDebugPrivilege
                                                                                                                                                                          • API String ID: 1606813200-2896544425
                                                                                                                                                                          • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                                                                                          • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
                                                                                                                                                                          • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                                                                                          • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
                                                                                                                                                                          Function 0040D6D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
                                                                                                                                                                            • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Purchase Order.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
                                                                                                                                                                          • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
                                                                                                                                                                          • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\Purchase Order.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
                                                                                                                                                                            • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\Purchase Order.exe,00000004), ref: 0040D7D6
                                                                                                                                                                          • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\Purchase Order.exe,00000004), ref: 00431B0E
                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\Purchase Order.exe,00000004), ref: 00431B3F
                                                                                                                                                                          • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
                                                                                                                                                                          • ShellExecuteW.SHELL32(00000000), ref: 00431B92
                                                                                                                                                                            • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                                                                                            • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                                                                                            • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                                                                                            • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                                                                                            • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                                                                                            • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                                                                                            • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
                                                                                                                                                                            • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                                                                                            • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                                                                                            • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                                                                                            • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                                                                                            • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: LoadWindow$IconName$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_
                                                                                                                                                                          • String ID: @GH$@GH$C:\Users\user\Desktop\Purchase Order.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                                                                                                                                                                          • API String ID: 3436406043-2291806153
                                                                                                                                                                          • Opcode ID: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                                                                                                          • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
                                                                                                                                                                          • Opcode Fuzzy Hash: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                                                                                                          • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E
                                                                                                                                                                          Function 00434BEE Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
                                                                                                                                                                          • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
                                                                                                                                                                          • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00434C88
                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00434C9C
                                                                                                                                                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00434D35
                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00434D43
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                          • API String ID: 1409584000-438819550
                                                                                                                                                                          • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                                                                                          • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
                                                                                                                                                                          • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                                                                                          • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
                                                                                                                                                                          Function 0044BD29 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 178filestringCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\Purchase Order.exe,?,C:\Users\user\Desktop\Purchase Order.exe,004A8E80,C:\Users\user\Desktop\Purchase Order.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                            • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
                                                                                                                                                                          • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
                                                                                                                                                                          • DeleteFileW.KERNEL32(?), ref: 0044BED5
                                                                                                                                                                          • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
                                                                                                                                                                          • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
                                                                                                                                                                          • DeleteFileW.KERNEL32(?), ref: 0044BF17
                                                                                                                                                                          • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 0044BF35
                                                                                                                                                                          • MoveFileW.KERNEL32(?,?), ref: 0044BF51
                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 0044BF7E
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: File$Find$CloseCopyDeleteMove$AttributesFirstFullNameNextPathlstrcmpi
                                                                                                                                                                          • String ID: \*.*
                                                                                                                                                                          • API String ID: 2518010859-1173974218
                                                                                                                                                                          • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                                                                                          • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
                                                                                                                                                                          • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                                                                                          • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
                                                                                                                                                                          Function 00444078 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94timesleepCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Timetime$Sleep
                                                                                                                                                                          • String ID: BUTTON
                                                                                                                                                                          • API String ID: 4176159691-3405671355
                                                                                                                                                                          • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                                                                                          • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
                                                                                                                                                                          • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                                                                                          • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
                                                                                                                                                                          Function 00434D50 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 114fileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
                                                                                                                                                                          • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
                                                                                                                                                                          • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00434EB4
                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00434ECE
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
                                                                                                                                                                          • String ID: :$\$\??\%s
                                                                                                                                                                          • API String ID: 3827137101-3457252023
                                                                                                                                                                          • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                                                                                          • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
                                                                                                                                                                          • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                                                                                          • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
                                                                                                                                                                          Function 004364AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79shutdownCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
                                                                                                                                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
                                                                                                                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
                                                                                                                                                                          • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00436504
                                                                                                                                                                          • ExitWindowsEx.USER32(?,00000000), ref: 00436527
                                                                                                                                                                          • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
                                                                                                                                                                          • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                                                                                                                                                                          • String ID: SeShutdownPrivilege
                                                                                                                                                                          • API String ID: 2938487562-3733053543
                                                                                                                                                                          • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                                                                                          • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
                                                                                                                                                                          • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                                                                                          • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
                                                                                                                                                                          Function 00445DD3 Relevance: 16.7, APIs: 11, Instructions: 179COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
                                                                                                                                                                            • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
                                                                                                                                                                            • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
                                                                                                                                                                            • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
                                                                                                                                                                          • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
                                                                                                                                                                          • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
                                                                                                                                                                          • GetLengthSid.ADVAPI32(?), ref: 00445E92
                                                                                                                                                                          • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
                                                                                                                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
                                                                                                                                                                          • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
                                                                                                                                                                          • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
                                                                                                                                                                          • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
                                                                                                                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
                                                                                                                                                                          • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
                                                                                                                                                                          • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1255039815-0
                                                                                                                                                                          • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                                                                                          • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
                                                                                                                                                                          • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                                                                                          • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
                                                                                                                                                                          Function 0045D517 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 91COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D522
                                                                                                                                                                          • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
                                                                                                                                                                          • GetLastError.KERNEL32 ref: 0045D59D
                                                                                                                                                                          • SetErrorMode.KERNEL32(?), ref: 0045D629
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Error$Mode$DiskFreeLastSpace
                                                                                                                                                                          • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                                                                                                          • API String ID: 4194297153-14809454
                                                                                                                                                                          • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                                                                                          • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
                                                                                                                                                                          • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                                                                                          • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
                                                                                                                                                                          Function 004037E0 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 359COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
                                                                                                                                                                          • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
                                                                                                                                                                            • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
                                                                                                                                                                            • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
                                                                                                                                                                          Strings
                                                                                                                                                                          • Unterminated string, xrefs: 0042B9BA
                                                                                                                                                                          • Error opening the file, xrefs: 0042B8AC
                                                                                                                                                                          • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
                                                                                                                                                                          • _, xrefs: 00403B48
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ByteCharCurrentDirectoryMultiWide$FullNamePath
                                                                                                                                                                          • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                                                                                                                                                                          • API String ID: 522955547-188983378
                                                                                                                                                                          • Opcode ID: 9d3cc106af837a0ba3a302398e1680714f0cc5ac52ed53ec90940b3ab90f08f5
                                                                                                                                                                          • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
                                                                                                                                                                          • Opcode Fuzzy Hash: 9d3cc106af837a0ba3a302398e1680714f0cc5ac52ed53ec90940b3ab90f08f5
                                                                                                                                                                          • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
                                                                                                                                                                          Function 0047A999 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288comCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • OleInitialize.OLE32(00000000), ref: 0047AA03
                                                                                                                                                                          • CLSIDFromProgID.OLE32(00000000,?), ref: 0047AA27
                                                                                                                                                                          • CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
                                                                                                                                                                          • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
                                                                                                                                                                          • CoCreateInstanceEx.OLE32 ref: 0047AD06
                                                                                                                                                                          • CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
                                                                                                                                                                          Strings
                                                                                                                                                                          • NULL Pointer assignment, xrefs: 0047AD84
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CreateInitializeInstance$BlanketFromProgProxySecurity
                                                                                                                                                                          • String ID: NULL Pointer assignment
                                                                                                                                                                          • API String ID: 628432406-2785691316
                                                                                                                                                                          • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                                                                                          • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
                                                                                                                                                                          • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                                                                                          • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
                                                                                                                                                                          Function 0043614F Relevance: 12.1, APIs: 8, Instructions: 103COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
                                                                                                                                                                          • LoadResource.KERNEL32(?,00000000), ref: 004361AE
                                                                                                                                                                          • LockResource.KERNEL32(00000000), ref: 004361B5
                                                                                                                                                                          • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
                                                                                                                                                                          • LoadResource.KERNEL32(?,00000000), ref: 004361E4
                                                                                                                                                                          • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
                                                                                                                                                                          • LockResource.KERNEL32(?), ref: 004361FD
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Resource$FindLoadLock$Sizeof
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 4215241788-0
                                                                                                                                                                          • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                                                                                          • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
                                                                                                                                                                          • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                                                                                          • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
                                                                                                                                                                          Function 0047AD92 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251comCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • OleInitialize.OLE32(00000000), ref: 0047AE06
                                                                                                                                                                          • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
                                                                                                                                                                          • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
                                                                                                                                                                            • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                          • CLSIDFromProgID.OLE32(00000000,?,?), ref: 0047AFCC
                                                                                                                                                                          • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CopyVariant$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg
                                                                                                                                                                          • String ID: HH
                                                                                                                                                                          • API String ID: 3904779488-2761332787
                                                                                                                                                                          • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                                                                                          • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
                                                                                                                                                                          • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                                                                                          • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
                                                                                                                                                                          Function 0046483C Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • socket.WSOCK32(00000002,00000001,00000006,?,00000000), ref: 004648B0
                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
                                                                                                                                                                          • bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648DA
                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
                                                                                                                                                                          • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000005,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 0046492D
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ErrorLast$bindclosesocketsocket
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2609815416-0
                                                                                                                                                                          • Opcode ID: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                                                                                          • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
                                                                                                                                                                          • Opcode Fuzzy Hash: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                                                                                          • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
                                                                                                                                                                          Function 004223BC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53timethreadCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 004223F3
                                                                                                                                                                          • GetCurrentProcessId.KERNEL32 ref: 004223FF
                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00422407
                                                                                                                                                                          • GetTickCount.KERNEL32 ref: 0042240F
                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32(?), ref: 0042241B
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                                                                                                                          • String ID: (!+D
                                                                                                                                                                          • API String ID: 1445889803-2055998714
                                                                                                                                                                          • Opcode ID: f5f58df8b3066ca0205ef19db65b763b05621757b61e1ba64a9c786d5d6483bf
                                                                                                                                                                          • Instruction ID: fccd6c2f0e9de14ca193dd89c54efe282b2f985546ae9d4e91778ab0a4262a43
                                                                                                                                                                          • Opcode Fuzzy Hash: f5f58df8b3066ca0205ef19db65b763b05621757b61e1ba64a9c786d5d6483bf
                                                                                                                                                                          • Instruction Fuzzy Hash: 94115672E00124ABCB209BB4EE4855FB7F4FF58351F920976DD01E7210DAB49D00C798
                                                                                                                                                                          Function 00427859 Relevance: 9.5, Strings: 7, Instructions: 793COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID: 1#IND$1#INF$1#QNAN$1#SNAN$?$T$_iB
                                                                                                                                                                          • API String ID: 0-4145368158
                                                                                                                                                                          • Opcode ID: 40fd759e06795c51c6d44f44d3c5b8b210a1b9c9a66bbae5e363e359e7067c76
                                                                                                                                                                          • Instruction ID: 4c0c7ed0c9658f191bc49dc210f9e18f2f65a652a6defb2a8c1265378aa6e59e
                                                                                                                                                                          • Opcode Fuzzy Hash: 40fd759e06795c51c6d44f44d3c5b8b210a1b9c9a66bbae5e363e359e7067c76
                                                                                                                                                                          • Instruction Fuzzy Hash: A562C131E0466A8BDF24CFA8D8402EEB7B1FF55310F95816BD811AB381D7784A46CB99
                                                                                                                                                                          Function 00426DA1 Relevance: 9.2, APIs: 6, Instructions: 156memoryfileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 00423462: SetFilePointer.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,0041BD80,00000000,00000000,00000000,00000002,00000000,00000000), ref: 004234A4
                                                                                                                                                                            • Part of subcall function 00423462: GetLastError.KERNEL32(?,0041BD80,00000000,00000000,00000000,00000002,00000000,00000000,00000000,?,0041C46E,00000000,00000002,00000000,0048CB40,00000010), ref: 004234B1
                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000008,00001000,?,?,?,?,?,77A63140,00000109,00000000,?,?,0042598E,00000109,00000109), ref: 00426E0A
                                                                                                                                                                          • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,77A63140,00000109,00000000,?,?,0042598E,00000109,00000109), ref: 00426E11
                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,77A63140,00000109,00000000,?,?,0042598E), ref: 00426E8D
                                                                                                                                                                          • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,77A63140,00000109,00000000,?,?,0042598E,00000109), ref: 00426E94
                                                                                                                                                                          • SetEndOfFile.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,77A63140,00000109,00000000,?,?,0042598E), ref: 00426EEF
                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,77A63140,00000109,00000000,?,?,0042598E,00000109), ref: 00426F1C
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Heap$ErrorFileLastProcess$AllocFreePointer
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1354853467-0
                                                                                                                                                                          • Opcode ID: c77f5c4fbdd969b6395b23d28f869cdae7d1fae00b5a1ae8a4ef132f81dfdc60
                                                                                                                                                                          • Instruction ID: 42e05f79c57693437edf2df5a3fd70b8e7b48e5887b3da35eff89abe1339f9d1
                                                                                                                                                                          • Opcode Fuzzy Hash: c77f5c4fbdd969b6395b23d28f869cdae7d1fae00b5a1ae8a4ef132f81dfdc60
                                                                                                                                                                          • Instruction Fuzzy Hash: 8A410676A00125AEDF102FB8EC466AE7B75EF00324F57462AF934972A0D77C4D518B98
                                                                                                                                                                          Function 00452126 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127filesleepCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
                                                                                                                                                                          • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
                                                                                                                                                                          • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
                                                                                                                                                                          • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Find$File$CloseFirstNextSleep
                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                          • API String ID: 1749430636-438819550
                                                                                                                                                                          • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                                                                                          • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
                                                                                                                                                                          • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                                                                                          • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
                                                                                                                                                                          Function 0046C5D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69clipboardCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                                                                                          • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                                                                                          • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                                                                                          • CloseClipboard.USER32 ref: 0046C65D
                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                                                                                          • CloseClipboard.USER32 ref: 0046C692
                                                                                                                                                                          • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                                                                                          • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                                                                                          • CloseClipboard.USER32 ref: 0046C866
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                                                                                          • String ID: HH
                                                                                                                                                                          • API String ID: 589737431-2761332787
                                                                                                                                                                          • Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                                                                                          • Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
                                                                                                                                                                          • Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                                                                                          • Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA
                                                                                                                                                                          Function 004741BB Relevance: 7.6, APIs: 5, Instructions: 137networkCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                                                                                          • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 00474213
                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 00474233
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ErrorLastinet_addrsocket
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 4170576061-0
                                                                                                                                                                          • Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                                                                                          • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
                                                                                                                                                                          • Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                                                                                          • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
                                                                                                                                                                          Function 00456354 Relevance: 7.6, APIs: 5, Instructions: 127keyboardCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                                                                                          • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                                                                                          • GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                                                                                          • GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00456430
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AsyncState$ClientCursorLongScreenWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3539004672-0
                                                                                                                                                                          • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                                                                                          • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
                                                                                                                                                                          • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                                                                                          • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
                                                                                                                                                                          Function 004772DE Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                          • IsWindowVisible.USER32 ref: 00477314
                                                                                                                                                                          • IsWindowEnabled.USER32 ref: 00477324
                                                                                                                                                                          • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
                                                                                                                                                                          • IsIconic.USER32 ref: 0047733F
                                                                                                                                                                          • IsZoomed.USER32 ref: 0047734D
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 292994002-0
                                                                                                                                                                          • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                                                                                          • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
                                                                                                                                                                          • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                                                                                          • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
                                                                                                                                                                          Function 00417D93 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00417E6F
                                                                                                                                                                          • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00417E79
                                                                                                                                                                          • UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00417E86
                                                                                                                                                                          • GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00417EA1
                                                                                                                                                                          • TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00417EA8
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2579439406-0
                                                                                                                                                                          • Opcode ID: 1e849d302d6523c4eca3589611bb7f1730917824b3e599ff67baae63fbfc1711
                                                                                                                                                                          • Instruction ID: 1e353620185c301eaa467651b296c472c2ab582025bec62c778f005c55eb3537
                                                                                                                                                                          • Opcode Fuzzy Hash: 1e849d302d6523c4eca3589611bb7f1730917824b3e599ff67baae63fbfc1711
                                                                                                                                                                          • Instruction Fuzzy Hash: 0A31D4B09013289BCB60DF65DD897C9BBB8AF18304F5045EEE50CA6251DBB85FC48F08
                                                                                                                                                                          Function 00436D2D Relevance: 7.6, APIs: 5, Instructions: 52filetimeCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,77A63220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                                                                                                                                                                          • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: File$CloseCreateHandleTime
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3397143404-0
                                                                                                                                                                          • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                                                                                          • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
                                                                                                                                                                          • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                                                                                          • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
                                                                                                                                                                          Function 0042039F Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 282timeCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 00417D93: IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00417E6F
                                                                                                                                                                            • Part of subcall function 00417D93: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00417E79
                                                                                                                                                                            • Part of subcall function 00417D93: UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00417E86
                                                                                                                                                                            • Part of subcall function 00417D93: GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00417EA1
                                                                                                                                                                            • Part of subcall function 00417D93: TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00417EA8
                                                                                                                                                                          • GetTimeZoneInformation.KERNEL32(00496C28), ref: 004204AA
                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(?,?,00496C2C,?,?,0000003F,?,?), ref: 00420528
                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(?,?,00496C80,000000FF,?,0000003F,?,?,?,00496C2C,?,?,0000003F,?,?), ref: 0042055C
                                                                                                                                                                            • Part of subcall function 00413A88: RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                                                                                            • Part of subcall function 00413A88: GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ByteCharExceptionFilterMultiProcessUnhandledWide$CurrentDebuggerErrorFreeHeapInformationLastPresentTerminateTimeZone
                                                                                                                                                                          • String ID: S\
                                                                                                                                                                          • API String ID: 4226027050-393906132
                                                                                                                                                                          • Opcode ID: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                                                                                                          • Instruction ID: b357f19af7064e56bcdb8625987f67de7edc2332d57e558cb2e7b84f91b73af7
                                                                                                                                                                          • Opcode Fuzzy Hash: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                                                                                                          • Instruction Fuzzy Hash: 6A91D371E00125AFDB20EF65EC819AE7BE9EF55300B95003BF540A7253DA3C89828F5C
                                                                                                                                                                          Function 0043701F Relevance: 6.1, APIs: 4, Instructions: 76processCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
                                                                                                                                                                          • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
                                                                                                                                                                          • Process32NextW.KERNEL32(00000000,?), ref: 00437075
                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?), ref: 00437105
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 420147892-0
                                                                                                                                                                          • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                                                                                          • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
                                                                                                                                                                          • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                                                                                          • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
                                                                                                                                                                          Function 00446566 Relevance: 5.9, Strings: 4, Instructions: 868COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID: ERCP$VUUU$VUUU$VUUU
                                                                                                                                                                          • API String ID: 0-2165971703
                                                                                                                                                                          • Opcode ID: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                                                                                          • Instruction ID: 514654dd073cfe12bfc68f6c44a091d7a3824994b709b832431b3f3de6bbd106
                                                                                                                                                                          • Opcode Fuzzy Hash: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                                                                                          • Instruction Fuzzy Hash: 5562D3716087818BE734CF18C8807ABB7E1EBC6314F154A2FE49986390E779D949CB5B
                                                                                                                                                                          Function 0044ED9A Relevance: 5.4, Strings: 4, Instructions: 448COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID: DEFINE$`$h$h
                                                                                                                                                                          • API String ID: 0-4194577831
                                                                                                                                                                          • Opcode ID: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                                                                                          • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
                                                                                                                                                                          • Opcode Fuzzy Hash: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                                                                                          • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
                                                                                                                                                                          Function 00436431 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
                                                                                                                                                                          • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: mouse_event
                                                                                                                                                                          • String ID: DOWN
                                                                                                                                                                          • API String ID: 2434400541-711622031
                                                                                                                                                                          • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                                                                                          • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
                                                                                                                                                                          • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                                                                                          • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
                                                                                                                                                                          Function 0045C999 Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
                                                                                                                                                                          • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Find$File$CloseFirstNext
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3541575487-0
                                                                                                                                                                          • Opcode ID: 14602e3ddb85434cb4a191148b4ac58dc13c9e22f939418703ff5d8e88b69fcb
                                                                                                                                                                          • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
                                                                                                                                                                          • Opcode Fuzzy Hash: 14602e3ddb85434cb4a191148b4ac58dc13c9e22f939418703ff5d8e88b69fcb
                                                                                                                                                                          • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
                                                                                                                                                                          Function 00436ADE Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
                                                                                                                                                                          • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00436B13
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: FileFind$AttributesCloseFirst
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 48322524-0
                                                                                                                                                                          • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                                                                                          • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
                                                                                                                                                                          • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                                                                                          • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
                                                                                                                                                                          Function 0044EBBC Relevance: 4.3, Strings: 3, Instructions: 551COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID: ACCEPT$^$h
                                                                                                                                                                          • API String ID: 0-4263704089
                                                                                                                                                                          • Opcode ID: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                                                                                          • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
                                                                                                                                                                          • Opcode Fuzzy Hash: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                                                                                          • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
                                                                                                                                                                          Function 0044289D Relevance: 3.1, APIs: 2, Instructions: 82networkfileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
                                                                                                                                                                          • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
                                                                                                                                                                            • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Internet$AvailableDataErrorFileLastQueryRead
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 901099227-0
                                                                                                                                                                          • Opcode ID: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
                                                                                                                                                                          • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
                                                                                                                                                                          • Opcode Fuzzy Hash: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
                                                                                                                                                                          • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
                                                                                                                                                                          Function 004230F5 Relevance: 3.1, APIs: 2, Instructions: 62COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004231F1
                                                                                                                                                                          • UnhandledExceptionFilter.KERNEL32(?), ref: 004231FE
                                                                                                                                                                            • Part of subcall function 004180A7: GetModuleFileNameA.KERNEL32(00000000,00496789,00000104,?,00411739,?,00401C0B), ref: 0041814A
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ExceptionFilterUnhandled$FileModuleName
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 787209826-0
                                                                                                                                                                          • Opcode ID: 1cbe704d86881204e8361e37842e1f13b131521e911a6f4d35389fdffc169e2d
                                                                                                                                                                          • Instruction ID: 9d34c63210c516c804ddbcbce3c521aa4eb8bf6faa5e2c9a58dfeebf86138d69
                                                                                                                                                                          • Opcode Fuzzy Hash: 1cbe704d86881204e8361e37842e1f13b131521e911a6f4d35389fdffc169e2d
                                                                                                                                                                          • Instruction Fuzzy Hash: 2C21E67091132D9ACB21EF659D897C9BBB8AF18704F1040EBA50CA6261DB789FC58F58
                                                                                                                                                                          Function 0045DD7C Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 0045DDDD
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2295610775-0
                                                                                                                                                                          • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                                                                                          • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
                                                                                                                                                                          • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                                                                                          • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
                                                                                                                                                                          Function 0047CBF0 Relevance: 2.9, Strings: 2, Instructions: 418COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID: 0vH$HH
                                                                                                                                                                          • API String ID: 0-728391547
                                                                                                                                                                          • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                                                                                          • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
                                                                                                                                                                          • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                                                                                          • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
                                                                                                                                                                          Function 0047E1FA Relevance: 2.0, APIs: 1, Instructions: 499COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DefDlgProcW.USER32(?,?,?,?,004A83D8,?), ref: 0047E22C
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Proc
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2346855178-0
                                                                                                                                                                          • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                                                                                          • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
                                                                                                                                                                          • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                                                                                          • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
                                                                                                                                                                          Function 00427161 Relevance: 1.9, Strings: 1, Instructions: 608COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID: 3gB
                                                                                                                                                                          • API String ID: 0-1795317511
                                                                                                                                                                          • Opcode ID: 6da754253abd2e35eb2e5a274ee4f9ff3dc2e5057a81817226e1356d575d6b11
                                                                                                                                                                          • Instruction ID: 325a13a96c06d4c98cee853255adfbe26994b6972aee23e03a37be849d38a260
                                                                                                                                                                          • Opcode Fuzzy Hash: 6da754253abd2e35eb2e5a274ee4f9ff3dc2e5057a81817226e1356d575d6b11
                                                                                                                                                                          • Instruction Fuzzy Hash: 25228B31E08229CBDF24CFA8E4503EDBBB1FB55314FA4816BD841AB385D7785882DB59
                                                                                                                                                                          Function 0041D750 Relevance: 1.8, APIs: 1, Instructions: 266COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • RaiseException.KERNEL32(?,00000000,00000001,?,00000000,0000FFFF,?,?,0041DA4A,?,?,?,?,?,0041DDE3,00000000), ref: 0041D974
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ExceptionRaise
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3997070919-0
                                                                                                                                                                          • Opcode ID: 3e752bb449efab522d3200141cf3dcee0c6bb4a1b97e107f9c0d62f6c5d4ee43
                                                                                                                                                                          • Instruction ID: 72ef4f9e9c7a35c4269090967bf6b9d23df6b64c3bcfe04dbdb27e9d628d6ebd
                                                                                                                                                                          • Opcode Fuzzy Hash: 3e752bb449efab522d3200141cf3dcee0c6bb4a1b97e107f9c0d62f6c5d4ee43
                                                                                                                                                                          • Instruction Fuzzy Hash: D0B191B1A10609CFDB18DF18C496AA67BE0FF44354F19865EE99A8F3E1C738D981CB44
                                                                                                                                                                          Function 0045A259 Relevance: 1.5, APIs: 1, Instructions: 21keyboardCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • BlockInput.USER32(00000001), ref: 0045A272
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: BlockInput
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3456056419-0
                                                                                                                                                                          • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                                                                                          • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
                                                                                                                                                                          • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                                                                                          • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
                                                                                                                                                                          Function 0043916A Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: LogonUser
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1244722697-0
                                                                                                                                                                          • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                                                                                          • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
                                                                                                                                                                          • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                                                                                          • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
                                                                                                                                                                          Function 004711D2 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: NameUser
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2645101109-0
                                                                                                                                                                          • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                                                                                          • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
                                                                                                                                                                          • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                                                                                          • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
                                                                                                                                                                          Function 0042202E Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ExceptionFilterUnhandled
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3192549508-0
                                                                                                                                                                          • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                                                                                          • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
                                                                                                                                                                          • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                                                                                          • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
                                                                                                                                                                          Function 00443390 Relevance: 1.3, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Time$FileSystem
                                                                                                                                                                          • String ID: rJ
                                                                                                                                                                          • API String ID: 2086374402-1865492326
                                                                                                                                                                          • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                                                                                          • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
                                                                                                                                                                          • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                                                                                          • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
                                                                                                                                                                          Function 00443391 Relevance: 1.3, Strings: 1, Instructions: 68COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Time$FileSystem
                                                                                                                                                                          • String ID: rJ
                                                                                                                                                                          • API String ID: 2086374402-1865492326
                                                                                                                                                                          • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                                                                                          • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
                                                                                                                                                                          • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                                                                                          • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
                                                                                                                                                                          Function 0040F890 Relevance: .6, Instructions: 589COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                                                                                          • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
                                                                                                                                                                          • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                                                                                          • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
                                                                                                                                                                          Function 00411B63 Relevance: .5, Instructions: 528COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: 8a3d5087dd20accb23969c3925dc540b0c919307cd436b6fa687a31edc4bc05f
                                                                                                                                                                          • Instruction ID: 587d2ccb264c520bda6fdd860f1d97339e5d8a8ab0720f255f163f1264fae3dc
                                                                                                                                                                          • Opcode Fuzzy Hash: 8a3d5087dd20accb23969c3925dc540b0c919307cd436b6fa687a31edc4bc05f
                                                                                                                                                                          • Instruction Fuzzy Hash: 7F02D133D497B34B8B314EF941E01A77EA05E0569130F47EADEC06F396C21ADD9A86E4
                                                                                                                                                                          Function 0042397B Relevance: .5, Instructions: 518COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: ea7ecdee6ac2e72654eecb9430e4f352bbd77c369f68d58dc27da5fc62acdc79
                                                                                                                                                                          • Instruction ID: 9e35f59c0add5ef17a89191b59ea5f5d96c4811c663926068cb485e9fd62b85b
                                                                                                                                                                          • Opcode Fuzzy Hash: ea7ecdee6ac2e72654eecb9430e4f352bbd77c369f68d58dc27da5fc62acdc79
                                                                                                                                                                          • Instruction Fuzzy Hash: 6802E932B105299BDF04CF69D4403ADB7B2FBD8316F65C67ED916A7290C3786A05CB84
                                                                                                                                                                          Function 00412C38 Relevance: .4, Instructions: 384COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                                                                                          • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
                                                                                                                                                                          • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                                                                                          • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
                                                                                                                                                                          Function 00412818 Relevance: .4, Instructions: 378COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                                                                                          • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
                                                                                                                                                                          • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                                                                                          • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
                                                                                                                                                                          Function 0041240C Relevance: .4, Instructions: 361COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                                                                                          • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
                                                                                                                                                                          • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                                                                                          • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
                                                                                                                                                                          Function 00412038 Relevance: .4, Instructions: 351COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                                                                                          • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
                                                                                                                                                                          • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                                                                                          • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
                                                                                                                                                                          Function 004212BE Relevance: .3, Instructions: 336COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: c47d925e012dda58e8a2147bbcbf95fd97a699f804f8c671293b5c898a81ed87
                                                                                                                                                                          • Instruction ID: edaac073b8829911ee68c4be0bcacd547f0c6bb47cd210bca20706155a8c2891
                                                                                                                                                                          • Opcode Fuzzy Hash: c47d925e012dda58e8a2147bbcbf95fd97a699f804f8c671293b5c898a81ed87
                                                                                                                                                                          • Instruction Fuzzy Hash: 19A1E571700571BBDB259F19A84457F73A2ABE8340BE90897E417DB230D639DC8286DE
                                                                                                                                                                          Function 0041A46B Relevance: .3, Instructions: 256COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: b0a81e3d32886a3826879c9bb5c7ff7792f7acd020c85209a7aca5b77f0b2be7
                                                                                                                                                                          • Instruction ID: a9eacd5bf21785df47d5f6a8feadd8f5aba99018e25b90ef92f88a0652348d6e
                                                                                                                                                                          • Opcode Fuzzy Hash: b0a81e3d32886a3826879c9bb5c7ff7792f7acd020c85209a7aca5b77f0b2be7
                                                                                                                                                                          • Instruction Fuzzy Hash: 4EB17C75901206DFCB15CF04C5D0AE8BBA2BF58318F18C1AED85A5B382D735EE96CB94
                                                                                                                                                                          Function 00410D10 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                                                                                          • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
                                                                                                                                                                          • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                                                                                          • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
                                                                                                                                                                          Function 00459384 Relevance: 75.7, APIs: 39, Strings: 4, Instructions: 480filewindowcomCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 004593D7
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 004593F1
                                                                                                                                                                          • DestroyWindow.USER32(?), ref: 00459407
                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 0045942A
                                                                                                                                                                          • GetWindowRect.USER32(00000000), ref: 00459431
                                                                                                                                                                          • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
                                                                                                                                                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
                                                                                                                                                                          • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
                                                                                                                                                                          • GetClientRect.USER32(00000000,?), ref: 004595C8
                                                                                                                                                                          • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
                                                                                                                                                                          • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
                                                                                                                                                                          • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00459668
                                                                                                                                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
                                                                                                                                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
                                                                                                                                                                          • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
                                                                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 004596C0
                                                                                                                                                                          • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
                                                                                                                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
                                                                                                                                                                          • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
                                                                                                                                                                          • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
                                                                                                                                                                          • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
                                                                                                                                                                          • GetStockObject.GDI32(00000011), ref: 004597B7
                                                                                                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 004597BF
                                                                                                                                                                          • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
                                                                                                                                                                          • DeleteDC.GDI32(00000000), ref: 004597E1
                                                                                                                                                                          • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
                                                                                                                                                                          • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
                                                                                                                                                                          • GetDC.USER32(?), ref: 004598DE
                                                                                                                                                                          • SelectObject.GDI32(00000000,?), ref: 004598EE
                                                                                                                                                                          • SelectObject.GDI32(00000000,?), ref: 00459919
                                                                                                                                                                          • ReleaseDC.USER32(?,00000000), ref: 00459925
                                                                                                                                                                          • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
                                                                                                                                                                          • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock
                                                                                                                                                                          • String ID: $AutoIt v3$DISPLAY$static
                                                                                                                                                                          • API String ID: 1538203242-2373415609
                                                                                                                                                                          • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                                                                                          • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
                                                                                                                                                                          • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                                                                                          • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
                                                                                                                                                                          Function 00441E05 Relevance: 49.8, APIs: 33, Instructions: 276COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetSysColor.USER32(00000012), ref: 00441E64
                                                                                                                                                                          • SetTextColor.GDI32(?,?), ref: 00441E6C
                                                                                                                                                                          • GetSysColorBrush.USER32(0000000F), ref: 00441E83
                                                                                                                                                                          • GetSysColor.USER32(0000000F), ref: 00441E8F
                                                                                                                                                                          • SetBkColor.GDI32(?,?), ref: 00441EAA
                                                                                                                                                                          • SelectObject.GDI32(?,?), ref: 00441EBA
                                                                                                                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00441EF0
                                                                                                                                                                          • GetSysColor.USER32(00000010), ref: 00441EF8
                                                                                                                                                                          • CreateSolidBrush.GDI32(00000000), ref: 00441EFF
                                                                                                                                                                          • FrameRect.USER32(?,?,00000000), ref: 00441F10
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 00441F1B
                                                                                                                                                                          • InflateRect.USER32(?,000000FE,000000FE), ref: 00441F75
                                                                                                                                                                          • FillRect.USER32(?,?,?), ref: 00441FB6
                                                                                                                                                                            • Part of subcall function 00433D5C: GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                                                                                                            • Part of subcall function 00433D5C: SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                                                                                                            • Part of subcall function 00433D5C: GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                                                                                                            • Part of subcall function 00433D5C: GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                                                                                                            • Part of subcall function 00433D5C: GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                                                                                                            • Part of subcall function 00433D5C: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                                                                                                            • Part of subcall function 00433D5C: SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                                                                                                            • Part of subcall function 00433D5C: SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                                                                                                            • Part of subcall function 00433D5C: SelectObject.GDI32(?,?), ref: 00433E29
                                                                                                                                                                            • Part of subcall function 00433D5C: InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                                                                                                            • Part of subcall function 00433D5C: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                                                                                                            • Part of subcall function 00433D5C: GetWindowLongW.USER32 ref: 00433E8A
                                                                                                                                                                            • Part of subcall function 00433D5C: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Color$Rect$Object$BrushInflateSelect$CreateText$DeleteFillFrameLongMessageRoundSendSolidWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 69173610-0
                                                                                                                                                                          • Opcode ID: 63a2be33accb074b4178bb2d7a96f271ea41f5903b36f57aa3a0bb7ff7b8698e
                                                                                                                                                                          • Instruction ID: 0b0c06e318eae1aa70623bc76f746578ebcda4f465cb69034399d4c57c44293d
                                                                                                                                                                          • Opcode Fuzzy Hash: 63a2be33accb074b4178bb2d7a96f271ea41f5903b36f57aa3a0bb7ff7b8698e
                                                                                                                                                                          • Instruction Fuzzy Hash: BBB14D71508300AFD314DF64DD88A6FB7F8FB88720F504A2DF996922A0D774E845CB66
                                                                                                                                                                          Function 00433D5C Relevance: 42.2, APIs: 28, Instructions: 198windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                                                                                                          • SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                                                                                                          • GetSysColor.USER32(00000012), ref: 00433DA3
                                                                                                                                                                          • SetTextColor.GDI32(?,?), ref: 00433DAB
                                                                                                                                                                          • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                                                                                                          • GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                                                                                                          • CreateSolidBrush.GDI32(?), ref: 00433DD4
                                                                                                                                                                          • GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                                                                                                          • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                                                                                                          • SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                                                                                                          • SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                                                                                                          • SelectObject.GDI32(?,?), ref: 00433E29
                                                                                                                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                                                                                                          • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                                                                                                          • GetWindowLongW.USER32 ref: 00433E8A
                                                                                                                                                                          • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                                                                                                          • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
                                                                                                                                                                          • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
                                                                                                                                                                          • DrawFocusRect.USER32(?,?), ref: 00433F1F
                                                                                                                                                                          • GetSysColor.USER32(00000011), ref: 00433F2E
                                                                                                                                                                          • SetTextColor.GDI32(?,00000000), ref: 00433F36
                                                                                                                                                                          • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
                                                                                                                                                                          • SelectObject.GDI32(?,?), ref: 00433F63
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 00433F70
                                                                                                                                                                          • SelectObject.GDI32(?,?), ref: 00433F78
                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 00433F7B
                                                                                                                                                                          • SetTextColor.GDI32(?,?), ref: 00433F83
                                                                                                                                                                          • SetBkColor.GDI32(?,?), ref: 00433F8F
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1582027408-0
                                                                                                                                                                          • Opcode ID: e151e7129dedd9b649cf5279759d6c8ca4f2d2edd5ec07a1e2c3294b07796789
                                                                                                                                                                          • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
                                                                                                                                                                          • Opcode Fuzzy Hash: e151e7129dedd9b649cf5279759d6c8ca4f2d2edd5ec07a1e2c3294b07796789
                                                                                                                                                                          • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
                                                                                                                                                                          Function 0046C604 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 216clipboardCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                                                                                          • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                                                                                          • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                                                                                          • CloseClipboard.USER32 ref: 0046C65D
                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                                                                                          • CloseClipboard.USER32 ref: 0046C692
                                                                                                                                                                          • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                                                                                          • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                                                                                          • CloseClipboard.USER32 ref: 0046C866
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                                                                                          • String ID: HH
                                                                                                                                                                          • API String ID: 589737431-2761332787
                                                                                                                                                                          • Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                                                                                          • Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
                                                                                                                                                                          • Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                                                                                          • Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA
                                                                                                                                                                          Function 0045657D Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 287windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 00456692
                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 004566AA
                                                                                                                                                                          • GetWindowRect.USER32(00000000), ref: 004566B1
                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0045670D
                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00456720
                                                                                                                                                                          • DestroyWindow.USER32(?), ref: 00456731
                                                                                                                                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
                                                                                                                                                                          • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
                                                                                                                                                                          • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
                                                                                                                                                                          • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
                                                                                                                                                                          • IsWindowVisible.USER32(?), ref: 00456812
                                                                                                                                                                          • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
                                                                                                                                                                          • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 0045685C
                                                                                                                                                                          • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
                                                                                                                                                                          • GetMonitorInfoW.USER32 ref: 00456894
                                                                                                                                                                          • CopyRect.USER32(?,?), ref: 004568A8
                                                                                                                                                                          • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
                                                                                                                                                                          • String ID: ($,$tooltips_class32
                                                                                                                                                                          • API String ID: 541082891-3320066284
                                                                                                                                                                          • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                                                                                          • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
                                                                                                                                                                          • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                                                                                          • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
                                                                                                                                                                          Function 004559A8 Relevance: 33.7, APIs: 18, Strings: 1, Instructions: 401COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID: 0
                                                                                                                                                                          • API String ID: 0-4108050209
                                                                                                                                                                          • Opcode ID: 3341d5ccd3f52121a0b9d5f5b9edb9a4c3413db68c9c5c7597b80800bbf161ae
                                                                                                                                                                          • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
                                                                                                                                                                          • Opcode Fuzzy Hash: 3341d5ccd3f52121a0b9d5f5b9edb9a4c3413db68c9c5c7597b80800bbf161ae
                                                                                                                                                                          • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
                                                                                                                                                                          Function 004700B0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 004701EA
                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 004701FA
                                                                                                                                                                          • GetSystemMetrics.USER32(00000007), ref: 00470202
                                                                                                                                                                          • GetSystemMetrics.USER32(00000008), ref: 00470216
                                                                                                                                                                          • GetSystemMetrics.USER32(00000004), ref: 00470238
                                                                                                                                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0047026B
                                                                                                                                                                          • GetSystemMetrics.USER32(00000007), ref: 00470273
                                                                                                                                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004702A0
                                                                                                                                                                          • GetSystemMetrics.USER32(00000008), ref: 004702A8
                                                                                                                                                                          • GetSystemMetrics.USER32(00000004), ref: 004702CF
                                                                                                                                                                          • SetRect.USER32(?,00000000,00000000,?,?), ref: 004702F1
                                                                                                                                                                          • AdjustWindowRectEx.USER32(?,?,00000000,000000FF), ref: 00470304
                                                                                                                                                                          • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 0047033E
                                                                                                                                                                          • SetWindowLongW.USER32(00000000,000000EB,?), ref: 00470356
                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 00470371
                                                                                                                                                                          • GetStockObject.GDI32(00000011), ref: 00470391
                                                                                                                                                                          • SendMessageW.USER32(?,00000030,00000000), ref: 0047039D
                                                                                                                                                                          • SetTimer.USER32(00000000,00000000,00000028,Function_00061E7F), ref: 004703C4
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer
                                                                                                                                                                          • String ID: AutoIt v3 GUI
                                                                                                                                                                          • API String ID: 2872485747-248962490
                                                                                                                                                                          • Opcode ID: 0d702e1f111dc4b461eb7f98f3a5a74387d5f37c8fb6fd827a42ca67ae032642
                                                                                                                                                                          • Instruction ID: 96ed3905d942d8c5c267f8207effb08aff50268186fc7250a269a1908d1679c9
                                                                                                                                                                          • Opcode Fuzzy Hash: 0d702e1f111dc4b461eb7f98f3a5a74387d5f37c8fb6fd827a42ca67ae032642
                                                                                                                                                                          • Instruction Fuzzy Hash: 27B19F71205301AFD324DF68DD45B6BB7E4FB88710F108A2EFA9587290DBB5E844CB5A
                                                                                                                                                                          Function 00448759 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 311COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window
                                                                                                                                                                          • String ID: 0
                                                                                                                                                                          • API String ID: 2353593579-4108050209
                                                                                                                                                                          • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                                                                                          • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
                                                                                                                                                                          • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                                                                                          • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
                                                                                                                                                                          Function 0044A0EA Relevance: 31.7, APIs: 21, Instructions: 196windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetSysColor.USER32 ref: 0044A11D
                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 0044A18D
                                                                                                                                                                          • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
                                                                                                                                                                          • GetWindowDC.USER32(?), ref: 0044A1B3
                                                                                                                                                                          • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
                                                                                                                                                                          • ReleaseDC.USER32(?,00000000), ref: 0044A1D6
                                                                                                                                                                          • GetSysColor.USER32(0000000F), ref: 0044A1EC
                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0044A207
                                                                                                                                                                          • GetSysColor.USER32(0000000F), ref: 0044A216
                                                                                                                                                                          • GetSysColor.USER32(00000005), ref: 0044A21E
                                                                                                                                                                          • GetWindowDC.USER32 ref: 0044A277
                                                                                                                                                                          • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
                                                                                                                                                                          • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
                                                                                                                                                                          • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
                                                                                                                                                                          • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
                                                                                                                                                                          • ReleaseDC.USER32(?,00000000), ref: 0044A2D8
                                                                                                                                                                          • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
                                                                                                                                                                          • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
                                                                                                                                                                          • GetStockObject.GDI32(00000005), ref: 0044A312
                                                                                                                                                                          • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1744303182-0
                                                                                                                                                                          • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                                                                                          • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
                                                                                                                                                                          • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                                                                                          • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
                                                                                                                                                                          Function 00476A8A Relevance: 27.3, APIs: 18, Instructions: 332COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: InitVariant
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1927566239-0
                                                                                                                                                                          • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                                                                                          • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
                                                                                                                                                                          • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                                                                                          • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
                                                                                                                                                                          Function 0046D6EB Relevance: 26.7, APIs: 6, Strings: 9, Instructions: 474COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 0046DBA4
                                                                                                                                                                          • IsWindow.USER32(?), ref: 0046DBDE
                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 0046DCB5
                                                                                                                                                                          • EnumChildWindows.USER32(00000000), ref: 0046DCBC
                                                                                                                                                                          • EnumWindows.USER32(00460772,?), ref: 0046DCC4
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$EnumForegroundWindows$ChildDesktop
                                                                                                                                                                          • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                                                                                                                          • API String ID: 4293069593-1919597938
                                                                                                                                                                          • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                                                                                          • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
                                                                                                                                                                          • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                                                                                          • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
                                                                                                                                                                          Function 004545C9 Relevance: 25.7, APIs: 17, Instructions: 198windowtimeCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadIconW.USER32(?,00000063), ref: 004545DA
                                                                                                                                                                          • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
                                                                                                                                                                          • SetWindowTextW.USER32(?,?), ref: 00454606
                                                                                                                                                                          • GetDlgItem.USER32(?,000003EA), ref: 0045461F
                                                                                                                                                                          • SetWindowTextW.USER32(00000000,?), ref: 00454626
                                                                                                                                                                          • GetDlgItem.USER32(?,000003E9), ref: 00454637
                                                                                                                                                                          • SetWindowTextW.USER32(00000000,?), ref: 0045463E
                                                                                                                                                                          • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
                                                                                                                                                                          • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00454688
                                                                                                                                                                          • SetWindowTextW.USER32(?,?), ref: 004546FD
                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 00454708
                                                                                                                                                                          • GetWindowRect.USER32(00000000), ref: 0045470F
                                                                                                                                                                          • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 0045476F
                                                                                                                                                                          • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
                                                                                                                                                                          • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3869813825-0
                                                                                                                                                                          • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                                                                                          • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
                                                                                                                                                                          • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                                                                                          • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
                                                                                                                                                                          Function 00458D1C Relevance: 25.6, APIs: 17, Instructions: 112COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
                                                                                                                                                                          • GetCursorInfo.USER32 ref: 00458E03
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Cursor$Load$Info
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2577412497-0
                                                                                                                                                                          • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                                                                                          • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
                                                                                                                                                                          • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                                                                                          • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
                                                                                                                                                                          Function 00454DAA Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 203windowlibraryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00454E65
                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,?,?,?,?,?,00000000), ref: 00454E79
                                                                                                                                                                          • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454EB7
                                                                                                                                                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00454EFB
                                                                                                                                                                          • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454F2C
                                                                                                                                                                          • FreeLibrary.KERNEL32(00000000), ref: 00454F37
                                                                                                                                                                          • ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 00454F94
                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 00454FA2
                                                                                                                                                                          • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00454FC0
                                                                                                                                                                          • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00454FCC
                                                                                                                                                                          • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00454FF1
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFreeMoveWindow
                                                                                                                                                                          • String ID: .dll$.exe$.icl
                                                                                                                                                                          • API String ID: 3474547544-1154884017
                                                                                                                                                                          • Opcode ID: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                                                                                          • Instruction ID: 777b7c61fe84a0ac0f88e3bb9536c5d4e291b97e4b5026f6b39318954af55ba4
                                                                                                                                                                          • Opcode Fuzzy Hash: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                                                                                          • Instruction Fuzzy Hash: D461D9711043016AE620DF659D85F7B73ECEF84B0AF00481EFE81D5182E7B9A989C77A
                                                                                                                                                                          Function 00469681 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 253windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
                                                                                                                                                                          • GetFocus.USER32 ref: 004696E0
                                                                                                                                                                          • GetDlgCtrlID.USER32(00000000), ref: 004696EB
                                                                                                                                                                          • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessagePost$CtrlFocus
                                                                                                                                                                          • String ID: 0
                                                                                                                                                                          • API String ID: 1534620443-4108050209
                                                                                                                                                                          • Opcode ID: 833d13db40ec40dec0483232b6284f8533ca83f9805c84b893a2fb0fb577edd9
                                                                                                                                                                          • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
                                                                                                                                                                          • Opcode Fuzzy Hash: 833d13db40ec40dec0483232b6284f8533ca83f9805c84b893a2fb0fb577edd9
                                                                                                                                                                          • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
                                                                                                                                                                          Function 004556F8 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DestroyWindow.USER32(?,004A83D8,?), ref: 00455800
                                                                                                                                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$CreateDestroy
                                                                                                                                                                          • String ID: ,$tooltips_class32
                                                                                                                                                                          • API String ID: 1109047481-3856767331
                                                                                                                                                                          • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                                                                                          • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
                                                                                                                                                                          • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                                                                                          • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
                                                                                                                                                                          Function 004680EB Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 204windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
                                                                                                                                                                          • GetMenuItemCount.USER32(?), ref: 00468227
                                                                                                                                                                          • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
                                                                                                                                                                          • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
                                                                                                                                                                          • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
                                                                                                                                                                          • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
                                                                                                                                                                          • GetMenuItemCount.USER32 ref: 004682DC
                                                                                                                                                                          • SetMenuItemInfoW.USER32 ref: 00468317
                                                                                                                                                                          • GetCursorPos.USER32(00000000), ref: 00468322
                                                                                                                                                                          • SetForegroundWindow.USER32(?), ref: 0046832D
                                                                                                                                                                          • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
                                                                                                                                                                          • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow
                                                                                                                                                                          • String ID: 0
                                                                                                                                                                          • API String ID: 1441871840-4108050209
                                                                                                                                                                          • Opcode ID: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                                                                                          • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
                                                                                                                                                                          • Opcode Fuzzy Hash: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                                                                                          • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
                                                                                                                                                                          Function 0046F2B0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 185windowfileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
                                                                                                                                                                            • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                                                                                            • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                                                                                            • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                                                                                          • SendMessageW.USER32(?), ref: 0046F34C
                                                                                                                                                                          • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
                                                                                                                                                                          • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
                                                                                                                                                                          • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
                                                                                                                                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
                                                                                                                                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
                                                                                                                                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
                                                                                                                                                                          • DragFinish.SHELL32(?), ref: 0046F414
                                                                                                                                                                          • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow
                                                                                                                                                                          • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                                                                                          • API String ID: 826844858-3440237614
                                                                                                                                                                          • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                                                                                          • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
                                                                                                                                                                          • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                                                                                          • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
                                                                                                                                                                          Function 0046FB53 Relevance: 22.7, APIs: 15, Instructions: 176windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
                                                                                                                                                                          • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
                                                                                                                                                                          • SendMessageW.USER32 ref: 0046FBAF
                                                                                                                                                                          • SendMessageW.USER32 ref: 0046FBE2
                                                                                                                                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001), ref: 0046FC1B
                                                                                                                                                                          • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
                                                                                                                                                                          • ImageList_Create.COMCTL32(00000020,00000020,00000021,?,00000001), ref: 0046FC51
                                                                                                                                                                          • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
                                                                                                                                                                          • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FC97
                                                                                                                                                                          • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FCA5
                                                                                                                                                                          • SendMessageW.USER32 ref: 0046FD00
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$IconImageList_$CreateExtractReplace
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2632138820-0
                                                                                                                                                                          • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                                                                                          • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
                                                                                                                                                                          • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                                                                                          • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
                                                                                                                                                                          Function 00433BAC Relevance: 22.6, APIs: 15, Instructions: 79COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CursorLoad
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3238433803-0
                                                                                                                                                                          • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                                                                                          • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
                                                                                                                                                                          • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                                                                                          • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
                                                                                                                                                                          Function 0045F48E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 226windowsleepCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
                                                                                                                                                                          • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
                                                                                                                                                                          • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: InfoItemMenu$Sleep
                                                                                                                                                                          • String ID: 0
                                                                                                                                                                          • API String ID: 1196289194-4108050209
                                                                                                                                                                          • Opcode ID: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                                                                                          • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
                                                                                                                                                                          • Opcode Fuzzy Hash: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                                                                                          • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
                                                                                                                                                                          Function 0047D5F6 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 210COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: FreeFromStringTask
                                                                                                                                                                          • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
                                                                                                                                                                          • API String ID: 910554386-934586222
                                                                                                                                                                          • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                                                                                          • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
                                                                                                                                                                          • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                                                                                          • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
                                                                                                                                                                          Function 00434506 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetDC.USER32(00000000), ref: 00434585
                                                                                                                                                                          • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
                                                                                                                                                                          • CreateCompatibleDC.GDI32(00000000), ref: 0043459B
                                                                                                                                                                          • SelectObject.GDI32(00000000,?), ref: 004345A9
                                                                                                                                                                          • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
                                                                                                                                                                          • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
                                                                                                                                                                          • String ID: (
                                                                                                                                                                          • API String ID: 3300687185-3887548279
                                                                                                                                                                          • Opcode ID: 850e4e4f4a3144c0c65e94ebd0f1e451ef245c66964f5ba666016bedf541cb72
                                                                                                                                                                          • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
                                                                                                                                                                          • Opcode Fuzzy Hash: 850e4e4f4a3144c0c65e94ebd0f1e451ef245c66964f5ba666016bedf541cb72
                                                                                                                                                                          • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
                                                                                                                                                                          Function 0046F90E Relevance: 21.1, APIs: 14, Instructions: 147windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0046F911
                                                                                                                                                                          • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
                                                                                                                                                                          • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0046F950
                                                                                                                                                                          • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,00000000,00000000,00000000,00002010,?,000000F0), ref: 0046F95E
                                                                                                                                                                          • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
                                                                                                                                                                          • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0046F9CF
                                                                                                                                                                          • DestroyIcon.USER32(?,?,000000F7,00000001,00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9DD
                                                                                                                                                                          • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 0046FA4F
                                                                                                                                                                          • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0046FA68
                                                                                                                                                                          • DestroyIcon.USER32(?,?,000000F7,00000001,?), ref: 0046FA76
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Icon$Destroy$DeleteMessageObjectSend$ImageLoad$ExtractLongWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3412594756-0
                                                                                                                                                                          • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                                                                                          • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
                                                                                                                                                                          • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                                                                                          • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
                                                                                                                                                                          Function 0045D971 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 140COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                                                                                          • GetDriveTypeW.KERNEL32 ref: 0045DA30
                                                                                                                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
                                                                                                                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
                                                                                                                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: SendString$BuffCharDriveLowerType
                                                                                                                                                                          • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                                                                                          • API String ID: 1600147383-4113822522
                                                                                                                                                                          • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                                                                                          • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
                                                                                                                                                                          • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                                                                                          • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
                                                                                                                                                                          Function 004334CA Relevance: 21.1, APIs: 14, Instructions: 132filecommemoryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
                                                                                                                                                                          • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00433523
                                                                                                                                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
                                                                                                                                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
                                                                                                                                                                          • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
                                                                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 0043357B
                                                                                                                                                                          • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
                                                                                                                                                                          • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 00433603
                                                                                                                                                                          • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3969911579-0
                                                                                                                                                                          • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                                                                                          • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
                                                                                                                                                                          • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                                                                                          • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
                                                                                                                                                                          Function 0045510D Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 115windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetMenuItemInfoW.USER32 ref: 00455146
                                                                                                                                                                          • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
                                                                                                                                                                          • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
                                                                                                                                                                          • GetMenuItemCount.USER32(?), ref: 004551D9
                                                                                                                                                                          • SetMenu.USER32(?,00000000), ref: 004551E7
                                                                                                                                                                          • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
                                                                                                                                                                          • DrawMenuBar.USER32 ref: 00455207
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow
                                                                                                                                                                          • String ID: 0
                                                                                                                                                                          • API String ID: 956284711-4108050209
                                                                                                                                                                          • Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                                                                                          • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
                                                                                                                                                                          • Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                                                                                          • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
                                                                                                                                                                          Function 004582BF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165registryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5
                                                                                                                                                                          • CoTaskMemFree.OLE32(?,00000000), ref: 00458335
                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
                                                                                                                                                                          • RegQueryValueExW.ADVAPI32 ref: 00458381
                                                                                                                                                                          • CLSIDFromString.OLE32(00000000,?), ref: 004583AF
                                                                                                                                                                          • RegQueryValueExW.ADVAPI32 ref: 004583E8
                                                                                                                                                                          • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 004584BA
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: FromQueryStringValue$CloseFreeLoadOpenTaskType
                                                                                                                                                                          • String ID: Version$\TypeLib$interface\
                                                                                                                                                                          • API String ID: 3215668907-939221531
                                                                                                                                                                          • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                                                                                          • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
                                                                                                                                                                          • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                                                                                          • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
                                                                                                                                                                          Function 0044920C Relevance: 18.2, APIs: 12, Instructions: 243windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
                                                                                                                                                                          • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
                                                                                                                                                                          • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
                                                                                                                                                                          • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
                                                                                                                                                                          • SendMessageW.USER32(?,00000402,?), ref: 0044941C
                                                                                                                                                                          • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
                                                                                                                                                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$CharNext
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1350042424-0
                                                                                                                                                                          • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                                                                                          • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
                                                                                                                                                                          • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                                                                                          • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
                                                                                                                                                                          Function 00453B94 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
                                                                                                                                                                          • SetKeyboardState.USER32(?), ref: 00453C5A
                                                                                                                                                                          • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
                                                                                                                                                                          • GetKeyState.USER32(000000A0), ref: 00453C99
                                                                                                                                                                          • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
                                                                                                                                                                          • GetKeyState.USER32(000000A1), ref: 00453CDA
                                                                                                                                                                          • GetAsyncKeyState.USER32(00000011), ref: 00453D07
                                                                                                                                                                          • GetKeyState.USER32(00000011), ref: 00453D15
                                                                                                                                                                          • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
                                                                                                                                                                          • GetKeyState.USER32(00000012), ref: 00453D4D
                                                                                                                                                                          • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
                                                                                                                                                                          • GetKeyState.USER32(0000005B), ref: 00453D85
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: State$Async$Keyboard
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 541375521-0
                                                                                                                                                                          • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                                                                                          • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
                                                                                                                                                                          • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                                                                                          • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
                                                                                                                                                                          Function 00437DB1 Relevance: 18.2, APIs: 12, Instructions: 180COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetDlgItem.USER32(?,00000001), ref: 00437DD7
                                                                                                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00437DE9
                                                                                                                                                                          • MoveWindow.USER32(00000000,0000000A,?,?,?,00000000), ref: 00437E5C
                                                                                                                                                                          • GetDlgItem.USER32(?,00000002), ref: 00437E70
                                                                                                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00437E82
                                                                                                                                                                          • MoveWindow.USER32(00000000,?,00000000,?,?,00000000), ref: 00437EDB
                                                                                                                                                                          • GetDlgItem.USER32(?,000003E9), ref: 00437EEA
                                                                                                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00437EFC
                                                                                                                                                                          • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00437F46
                                                                                                                                                                          • GetDlgItem.USER32(?,000003EA), ref: 00437F55
                                                                                                                                                                          • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 00437F6E
                                                                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00437F78
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$ItemMoveRect$Invalidate
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3096461208-0
                                                                                                                                                                          • Opcode ID: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                                                                                          • Instruction ID: 6334a21bf5495bf578199e0a0c43900503e40640961724061e29feeedb49a886
                                                                                                                                                                          • Opcode Fuzzy Hash: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                                                                                          • Instruction Fuzzy Hash: 46511CB16083069FC318DF68DD85A2BB7E9ABC8300F144A2DF985D3391E6B4ED058B95
                                                                                                                                                                          Function 0046B39A Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 401registryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ConnectRegistry
                                                                                                                                                                          • String ID: HH
                                                                                                                                                                          • API String ID: 76216097-2761332787
                                                                                                                                                                          • Opcode ID: dd977f09bea9308b610c7238e96fb584538275b520f46e9374bb1ad9d3878166
                                                                                                                                                                          • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
                                                                                                                                                                          • Opcode Fuzzy Hash: dd977f09bea9308b610c7238e96fb584538275b520f46e9374bb1ad9d3878166
                                                                                                                                                                          • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
                                                                                                                                                                          Function 00460ABB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 294windowtimeCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
                                                                                                                                                                          • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
                                                                                                                                                                          • GetDlgCtrlID.USER32(?), ref: 00460CE6
                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00460D21
                                                                                                                                                                          • GetParent.USER32(?), ref: 00460D40
                                                                                                                                                                          • ScreenToClient.USER32(00000000), ref: 00460D47
                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
                                                                                                                                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
                                                                                                                                                                          • String ID: %s%u
                                                                                                                                                                          • API String ID: 1412819556-679674701
                                                                                                                                                                          • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                                                                                          • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
                                                                                                                                                                          • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                                                                                          • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
                                                                                                                                                                          Function 00475D8B Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 194COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                                                                                          • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: BuffCharDriveLowerType
                                                                                                                                                                          • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
                                                                                                                                                                          • API String ID: 2426244813-4176887700
                                                                                                                                                                          • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                                                                                          • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
                                                                                                                                                                          • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                                                                                          • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
                                                                                                                                                                          Function 0045DE12 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 190timeCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetLocalTime.KERNEL32(?), ref: 0045DED4
                                                                                                                                                                          • SystemTimeToFileTime.KERNEL32(?,?), ref: 0045DEE4
                                                                                                                                                                          • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0045DEF0
                                                                                                                                                                          • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0045DF93
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFA7
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFE5
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFFB
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0045E00D
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0045E05F
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CurrentDirectory$Time$File$Local$System
                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                          • API String ID: 1599115645-438819550
                                                                                                                                                                          • Opcode ID: 89541da3f554ebb8d42e95f45bc66f31ca584aff69b040987f949bd9346ecb30
                                                                                                                                                                          • Instruction ID: 9ef8ac46b2ec3f8a2b66e183c5d6435db2730cdd54c1860218fefef83dfd89d7
                                                                                                                                                                          • Opcode Fuzzy Hash: 89541da3f554ebb8d42e95f45bc66f31ca584aff69b040987f949bd9346ecb30
                                                                                                                                                                          • Instruction Fuzzy Hash: D061A7B25043049BC724EF65C881E9FB3E8AF94704F048E1EF98987241DB79E949CB96
                                                                                                                                                                          Function 0046F50B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 157windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                                                                                            • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                                                                                            • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                                                                                            • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                                                                                          • DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
                                                                                                                                                                          • ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
                                                                                                                                                                          • ImageList_EndDrag.COMCTL32 ref: 0046F583
                                                                                                                                                                          • ReleaseCapture.USER32 ref: 0046F589
                                                                                                                                                                          • SetWindowTextW.USER32(?,00000000), ref: 0046F620
                                                                                                                                                                          • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
                                                                                                                                                                          • String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
                                                                                                                                                                          • API String ID: 2483343779-2060113733
                                                                                                                                                                          • Opcode ID: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
                                                                                                                                                                          • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
                                                                                                                                                                          • Opcode Fuzzy Hash: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
                                                                                                                                                                          • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
                                                                                                                                                                          Function 0046FD7F Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 143windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
                                                                                                                                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,004A83D8,?), ref: 0046FDF0
                                                                                                                                                                          • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
                                                                                                                                                                          • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,004A83D8,?), ref: 0046FE20
                                                                                                                                                                          • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
                                                                                                                                                                          • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 0046FEF2
                                                                                                                                                                          • RedrawWindow.USER32(?,?,00000000,00000000), ref: 0046FF02
                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 0046FFCC
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
                                                                                                                                                                          • String ID: 2
                                                                                                                                                                          • API String ID: 1331449709-450215437
                                                                                                                                                                          • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                                                                                          • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
                                                                                                                                                                          • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                                                                                          • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
                                                                                                                                                                          Function 004580E1 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 136registryshareCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
                                                                                                                                                                          • CLSIDFromString.OLE32(00000000,?), ref: 00458279
                                                                                                                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
                                                                                                                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 00458296
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
                                                                                                                                                                          • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                                                                                          • API String ID: 3030280669-22481851
                                                                                                                                                                          • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                                                                                          • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
                                                                                                                                                                          • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                                                                                          • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
                                                                                                                                                                          Function 00450E7D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?,?,00000000,static,00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 00450EE1
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: DestroyWindow
                                                                                                                                                                          • String ID: static
                                                                                                                                                                          • API String ID: 3375834691-2160076837
                                                                                                                                                                          • Opcode ID: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                                                                                                          • Instruction ID: 4605c95b1b006c90d65e271c0fdf07f62d21d56273c2870bf7f2e3decf5281c5
                                                                                                                                                                          • Opcode Fuzzy Hash: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                                                                                                          • Instruction Fuzzy Hash: 4531B572200300BBD7109B64DC45F6BB3A8EBC9711F204A2EFA50D72C0D7B4E8048B69
                                                                                                                                                                          Function 004584D6 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 105registryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
                                                                                                                                                                          • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
                                                                                                                                                                          • IIDFromString.OLE32(?,?,?,?), ref: 004585EB
                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 004585F8
                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 00458615
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CloseOpen$EnumFromQueryStringValue
                                                                                                                                                                          • String ID: ($interface$interface\
                                                                                                                                                                          • API String ID: 297354694-3327702407
                                                                                                                                                                          • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                                                                                          • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
                                                                                                                                                                          • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                                                                                          • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
                                                                                                                                                                          Function 0045D83D Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 86COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D848
                                                                                                                                                                          • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
                                                                                                                                                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ErrorMode$DriveType
                                                                                                                                                                          • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
                                                                                                                                                                          • API String ID: 2907320926-41864084
                                                                                                                                                                          • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                                                                                          • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
                                                                                                                                                                          • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                                                                                          • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
                                                                                                                                                                          Function 0043737D Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 83windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadIconW.USER32(00000000,00007F04), ref: 00437467
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: IconLoad
                                                                                                                                                                          • String ID: blank$info$question$stop$warning
                                                                                                                                                                          • API String ID: 2457776203-404129466
                                                                                                                                                                          • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                                                                                          • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
                                                                                                                                                                          • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                                                                                          • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
                                                                                                                                                                          Function 0041D221 Relevance: 16.8, APIs: 11, Instructions: 340COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LCMapStringW.KERNEL32(00000000,00000100,004832AC,00000001,00000000,00000000,00000000,00000100,?,?,?,?,?,00000000,00000001,00000000), ref: 0041D253
                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?), ref: 0041D265
                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000100,?,?,?,?,?,00000000,00000001,00000000), ref: 0041D2F1
                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,?,?,?), ref: 0041D35D
                                                                                                                                                                          • LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,?,?), ref: 0041D379
                                                                                                                                                                          • LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 0041D3B3
                                                                                                                                                                          • LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 0041D417
                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041D43A
                                                                                                                                                                          • LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,00000000,00000100,?,?,?,?,?), ref: 0041D4CA
                                                                                                                                                                          • LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,00000100,?,?), ref: 0041D53C
                                                                                                                                                                          • LCMapStringA.KERNEL32(?,?,?,?,?,00000100,00000000,00000100,?,?,?,?,?,00000000,00000001,00000000), ref: 0041D589
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: String$ByteCharMultiWide$ErrorLast
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1775797328-0
                                                                                                                                                                          • Opcode ID: eb41e0d2d1b81e7a32cf906d4b734b1c9ec2c908055d8722ab31c7c9aa7183c2
                                                                                                                                                                          • Instruction ID: 1947c5d7a6bd7703781e4ff4e4219a867b2a08f70101b14ec9db93f8b40ae8b3
                                                                                                                                                                          • Opcode Fuzzy Hash: eb41e0d2d1b81e7a32cf906d4b734b1c9ec2c908055d8722ab31c7c9aa7183c2
                                                                                                                                                                          • Instruction Fuzzy Hash: FFB19AB2C00119BFCF119FA0DC818EF7BB6EB48358B14456BF915A2220D7399DE1DB99
                                                                                                                                                                          Function 00467214 Relevance: 16.8, APIs: 11, Instructions: 313COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
                                                                                                                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
                                                                                                                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
                                                                                                                                                                          • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
                                                                                                                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
                                                                                                                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
                                                                                                                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ArraySafe$Data$AccessUnaccess$Vartype
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1349711609-0
                                                                                                                                                                          • Opcode ID: 16f99e80be173eecdd1bb573f6b7f825babaa5351af7cc3efc94bb11c862a2f8
                                                                                                                                                                          • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
                                                                                                                                                                          • Opcode Fuzzy Hash: 16f99e80be173eecdd1bb573f6b7f825babaa5351af7cc3efc94bb11c862a2f8
                                                                                                                                                                          • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
                                                                                                                                                                          Function 0046EA7F Relevance: 16.7, APIs: 11, Instructions: 167windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                                                                                          • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0046EB04
                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0046EB18
                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0046EB24
                                                                                                                                                                          • DeleteObject.GDI32(00430000), ref: 0046EB4F
                                                                                                                                                                          • DestroyIcon.USER32(006E006F), ref: 0046EB67
                                                                                                                                                                          • DeleteObject.GDI32(C536F600), ref: 0046EB7F
                                                                                                                                                                          • DestroyWindow.USER32(00530045), ref: 0046EB97
                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 0046EBBF
                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 0046EBCD
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateRectTableWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 802431696-0
                                                                                                                                                                          • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                                                                                          • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
                                                                                                                                                                          • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                                                                                          • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
                                                                                                                                                                          Function 00444D52 Relevance: 16.6, APIs: 11, Instructions: 132keyboardCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
                                                                                                                                                                          • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
                                                                                                                                                                          • GetKeyState.USER32(000000A0), ref: 00444E26
                                                                                                                                                                          • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
                                                                                                                                                                          • GetKeyState.USER32(000000A1), ref: 00444E51
                                                                                                                                                                          • GetAsyncKeyState.USER32(00000011), ref: 00444E69
                                                                                                                                                                          • GetKeyState.USER32(00000011), ref: 00444E77
                                                                                                                                                                          • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
                                                                                                                                                                          • GetKeyState.USER32(00000012), ref: 00444E9D
                                                                                                                                                                          • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
                                                                                                                                                                          • GetKeyState.USER32(0000005B), ref: 00444EC3
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: State$Async$Keyboard
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 541375521-0
                                                                                                                                                                          • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                                                                                          • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
                                                                                                                                                                          • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                                                                                          • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
                                                                                                                                                                          Function 00479921 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 314COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CopyVariant$ErrorLast
                                                                                                                                                                          • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
                                                                                                                                                                          • API String ID: 2286883814-4206948668
                                                                                                                                                                          • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                                                                                          • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
                                                                                                                                                                          • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                                                                                          • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
                                                                                                                                                                          Function 00460473 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 255COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
                                                                                                                                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
                                                                                                                                                                          • CharUpperBuffW.USER32(?,00000000), ref: 00460510
                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00460589
                                                                                                                                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00460606
                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 004606AD
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ClassName$Window$Text$BuffCharRectUpper
                                                                                                                                                                          • String ID: ThumbnailClass
                                                                                                                                                                          • API String ID: 3725905772-1241985126
                                                                                                                                                                          • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                                                                                          • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
                                                                                                                                                                          • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                                                                                          • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
                                                                                                                                                                          Function 00436B3A Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00436B4E
                                                                                                                                                                          • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00436B73
                                                                                                                                                                          • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: FileInfoVersion$QuerySizeValue
                                                                                                                                                                          • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                                                                                                          • API String ID: 2179348866-1459072770
                                                                                                                                                                          • Opcode ID: 8f115a8dcca366765dccafad874a9911a33c709b0333e454bef2361e27f7839d
                                                                                                                                                                          • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
                                                                                                                                                                          • Opcode Fuzzy Hash: 8f115a8dcca366765dccafad874a9911a33c709b0333e454bef2361e27f7839d
                                                                                                                                                                          • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
                                                                                                                                                                          Function 0045E41B Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 150COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
                                                                                                                                                                          • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: LoadString
                                                                                                                                                                          • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
                                                                                                                                                                          • API String ID: 2948472770-2894483878
                                                                                                                                                                          • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                                                                                          • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
                                                                                                                                                                          • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                                                                                          • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
                                                                                                                                                                          Function 004393E2 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 109threadCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
                                                                                                                                                                          • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
                                                                                                                                                                          • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
                                                                                                                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
                                                                                                                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
                                                                                                                                                                          Strings
                                                                                                                                                                          • SeIncreaseQuotaPrivilege, xrefs: 0043946A
                                                                                                                                                                          • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread
                                                                                                                                                                          • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
                                                                                                                                                                          • API String ID: 2833215880-805462909
                                                                                                                                                                          • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                                                                                          • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
                                                                                                                                                                          • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                                                                                          • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
                                                                                                                                                                          Function 004691F4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
                                                                                                                                                                          • GetDlgCtrlID.USER32(00000000), ref: 00469289
                                                                                                                                                                          • GetParent.USER32 ref: 004692A4
                                                                                                                                                                          • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
                                                                                                                                                                          • GetDlgCtrlID.USER32(00000000), ref: 004692AE
                                                                                                                                                                          • GetParent.USER32 ref: 004692C7
                                                                                                                                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$CtrlParent
                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                          • API String ID: 1383977212-1403004172
                                                                                                                                                                          • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                                                                                          • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
                                                                                                                                                                          • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                                                                                          • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
                                                                                                                                                                          Function 004693F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
                                                                                                                                                                          • GetDlgCtrlID.USER32(00000000), ref: 00469483
                                                                                                                                                                          • GetParent.USER32 ref: 0046949E
                                                                                                                                                                          • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
                                                                                                                                                                          • GetDlgCtrlID.USER32(00000000), ref: 004694A8
                                                                                                                                                                          • GetParent.USER32 ref: 004694C1
                                                                                                                                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$CtrlParent
                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                          • API String ID: 1383977212-1403004172
                                                                                                                                                                          • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                                                                                          • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
                                                                                                                                                                          • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                                                                                          • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
                                                                                                                                                                          Function 00417BA8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • InterlockedIncrement.KERNEL32(00411739), ref: 00417BBA
                                                                                                                                                                          • InterlockedIncrement.KERNEL32(681574C0), ref: 00417BC7
                                                                                                                                                                          • InterlockedIncrement.KERNEL32(1015FF50), ref: 00417BD4
                                                                                                                                                                          • InterlockedIncrement.KERNEL32(CorExitProcess), ref: 00417BE1
                                                                                                                                                                          • InterlockedIncrement.KERNEL32(FF0574C0), ref: 00417BEE
                                                                                                                                                                          • InterlockedIncrement.KERNEL32(FF0574C0), ref: 00417C0A
                                                                                                                                                                          • InterlockedIncrement.KERNEL32(0048215C), ref: 00417C1A
                                                                                                                                                                          • InterlockedIncrement.KERNEL32(59FFFF4B), ref: 00417C30
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: IncrementInterlocked
                                                                                                                                                                          • String ID: CorExitProcess
                                                                                                                                                                          • API String ID: 3508698243-1124507085
                                                                                                                                                                          • Opcode ID: d1b0377c503bbdefda5610f0537bfa72825e28dfa37e5ae55eeee1a7a8820d3e
                                                                                                                                                                          • Instruction ID: fb61f0e31799d0698f30908f9b652ac69b024978f93be2849cd97143da64a8c5
                                                                                                                                                                          • Opcode Fuzzy Hash: d1b0377c503bbdefda5610f0537bfa72825e28dfa37e5ae55eeee1a7a8820d3e
                                                                                                                                                                          • Instruction Fuzzy Hash: 11111E71B04315ABDB249B69CC84F97BBACAF40784F044427A508D7241DB78F980CBE4
                                                                                                                                                                          Function 004480F2 Relevance: 15.2, APIs: 10, Instructions: 184windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
                                                                                                                                                                          • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 004481A7
                                                                                                                                                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
                                                                                                                                                                          • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
                                                                                                                                                                          • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
                                                                                                                                                                          • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
                                                                                                                                                                          • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
                                                                                                                                                                          • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
                                                                                                                                                                          • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$LongWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 312131281-0
                                                                                                                                                                          • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                                                                                          • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
                                                                                                                                                                          • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                                                                                          • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
                                                                                                                                                                          Function 00448DAF Relevance: 15.2, APIs: 10, Instructions: 173windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 004419ED: DeleteObject.GDI32(?), ref: 00441A53
                                                                                                                                                                          • SendMessageW.USER32(773105F0,00001001,00000000,00000000), ref: 00448E73
                                                                                                                                                                          • SendMessageW.USER32(773105F0,00001026,00000000,00000000), ref: 00448E7E
                                                                                                                                                                            • Part of subcall function 00441A7A: CreateSolidBrush.GDI32 ref: 00441ACB
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$BrushCreateDeleteObjectSolid
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3771399671-0
                                                                                                                                                                          • Opcode ID: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                                                                                          • Instruction ID: ebbecaf0548398ae771b9aa28ebf0b72f134f9ffbbfb28b2279bd799396bd9e3
                                                                                                                                                                          • Opcode Fuzzy Hash: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                                                                                          • Instruction Fuzzy Hash: F4510930208300AFE2209F25DD85F6F77EAEB85B14F14091EF994E72D0CBB9E9458769
                                                                                                                                                                          Function 004377B4 Relevance: 15.1, APIs: 10, Instructions: 97threadCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004377D7
                                                                                                                                                                          • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
                                                                                                                                                                          • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
                                                                                                                                                                          • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2156557900-0
                                                                                                                                                                          • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                                                                                          • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
                                                                                                                                                                          • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                                                                                          • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
                                                                                                                                                                          Function 00474335 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 308COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID: HH
                                                                                                                                                                          • API String ID: 0-2761332787
                                                                                                                                                                          • Opcode ID: a328fc3f0c2738e7ee23a6f39de9db46e7d7486e18f94bdfd929d974c39bc96d
                                                                                                                                                                          • Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
                                                                                                                                                                          • Opcode Fuzzy Hash: a328fc3f0c2738e7ee23a6f39de9db46e7d7486e18f94bdfd929d974c39bc96d
                                                                                                                                                                          • Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A
                                                                                                                                                                          Function 0042FE54 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 298sleepCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FE66
                                                                                                                                                                          • Sleep.KERNEL32(0000000A), ref: 0042FE6E
                                                                                                                                                                          • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FF5D
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: DecrementInterlocked$Sleep
                                                                                                                                                                          • String ID: 0vH$0vH$4RH0vH$@COM_EVENTOBJ
                                                                                                                                                                          • API String ID: 2250217261-3412429629
                                                                                                                                                                          • Opcode ID: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                                                                                                          • Instruction ID: 990b5f35a06538e4ae7b6c94f393f4a5fafaaf51bfa382c75dcb300f2d234fa3
                                                                                                                                                                          • Opcode Fuzzy Hash: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                                                                                                          • Instruction Fuzzy Hash: E0B1C0715083009FC714EF54C990A5FB3E4AF98304F508A2FF495972A2DB78ED4ACB9A
                                                                                                                                                                          Function 004689FF Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 288COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                                                                                                                          • API String ID: 0-1603158881
                                                                                                                                                                          • Opcode ID: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                                                                                          • Instruction ID: 1d39c91c6ba170ccd8bd44326015c92659356e06a413e753493f98454e3169a0
                                                                                                                                                                          • Opcode Fuzzy Hash: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                                                                                          • Instruction Fuzzy Hash: 49A1D3B14043459BCB20EF50CC81BDE37A4AF94348F44891FF9896B182EF79A64DC76A
                                                                                                                                                                          Function 0045CBCC Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 202COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
                                                                                                                                                                            • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                          • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
                                                                                                                                                                          • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CurrentDirectory$AttributesFile
                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                          • API String ID: 769691225-438819550
                                                                                                                                                                          • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                                                                                          • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
                                                                                                                                                                          • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                                                                                          • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
                                                                                                                                                                          Function 0046A75F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 179registryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ConnectRegistry
                                                                                                                                                                          • String ID: HH
                                                                                                                                                                          • API String ID: 76216097-2761332787
                                                                                                                                                                          • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                                                                                          • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
                                                                                                                                                                          • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                                                                                          • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
                                                                                                                                                                          Function 0045E62E Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 155COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
                                                                                                                                                                          • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: LoadString
                                                                                                                                                                          • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                                                                                          • API String ID: 2948472770-2354261254
                                                                                                                                                                          • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                                                                                          • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
                                                                                                                                                                          • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                                                                                          • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
                                                                                                                                                                          Function 00448602 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 105windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CreateMenu.USER32 ref: 0044863C
                                                                                                                                                                          • SetMenu.USER32(?,00000000), ref: 0044864C
                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
                                                                                                                                                                          • IsMenu.USER32(?), ref: 004486EB
                                                                                                                                                                          • CreatePopupMenu.USER32 ref: 004486F5
                                                                                                                                                                          • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
                                                                                                                                                                          • DrawMenuBar.USER32 ref: 00448742
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                                                                                                                                          • String ID: 0
                                                                                                                                                                          • API String ID: 161812096-4108050209
                                                                                                                                                                          • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                                                                                          • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
                                                                                                                                                                          • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                                                                                          • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
                                                                                                                                                                          Function 00445A77 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetParent.USER32 ref: 00445A8D
                                                                                                                                                                          • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ClassMessageNameParentSend
                                                                                                                                                                          • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                                                                                          • API String ID: 1290815626-3381328864
                                                                                                                                                                          • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                                                                                          • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
                                                                                                                                                                          • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                                                                                          • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
                                                                                                                                                                          Function 00428604 Relevance: 13.8, APIs: 9, Instructions: 306COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
                                                                                                                                                                          • GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CompareErrorLastString
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1733990998-0
                                                                                                                                                                          • Opcode ID: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                                                                                          • Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
                                                                                                                                                                          • Opcode Fuzzy Hash: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                                                                                          • Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58
                                                                                                                                                                          Function 00456168 Relevance: 13.7, APIs: 9, Instructions: 181COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                                                                                          • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
                                                                                                                                                                          • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                                                                                          • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
                                                                                                                                                                          Function 004417BC Relevance: 13.6, APIs: 9, Instructions: 142COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                                                                                          • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
                                                                                                                                                                          • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                                                                                          • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
                                                                                                                                                                          Function 00445CF9 Relevance: 13.6, APIs: 9, Instructions: 69sleepkeyboardwindowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
                                                                                                                                                                            • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
                                                                                                                                                                            • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
                                                                                                                                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
                                                                                                                                                                          • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
                                                                                                                                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
                                                                                                                                                                          • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
                                                                                                                                                                          • Sleep.KERNEL32(00000000), ref: 00445D70
                                                                                                                                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
                                                                                                                                                                          • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2014098862-0
                                                                                                                                                                          • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                                                                                          • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
                                                                                                                                                                          • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                                                                                          • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
                                                                                                                                                                          Function 0045E912 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 353timeCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • VariantInit.OLEAUT32(00000000), ref: 0045E959
                                                                                                                                                                          • VariantCopy.OLEAUT32(00000000), ref: 0045E963
                                                                                                                                                                          • VariantClear.OLEAUT32 ref: 0045E970
                                                                                                                                                                          • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
                                                                                                                                                                          • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
                                                                                                                                                                          • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
                                                                                                                                                                          Strings
                                                                                                                                                                          • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Variant$InitTime$ClearCopyFromSystem
                                                                                                                                                                          • String ID: %4d%02d%02d%02d%02d%02d
                                                                                                                                                                          • API String ID: 2968790880-1568723262
                                                                                                                                                                          • Opcode ID: 37b26c3e130c1a31af09048bf95897f87bf3bde4777f47a21ee6b10bd43e23e8
                                                                                                                                                                          • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
                                                                                                                                                                          • Opcode Fuzzy Hash: 37b26c3e130c1a31af09048bf95897f87bf3bde4777f47a21ee6b10bd43e23e8
                                                                                                                                                                          • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
                                                                                                                                                                          Function 00479C97 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 274COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • VariantInit.OLEAUT32(?), ref: 00479F06
                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 00479F11
                                                                                                                                                                          • VariantInit.OLEAUT32(?), ref: 00479DF7
                                                                                                                                                                            • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
                                                                                                                                                                            • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
                                                                                                                                                                            • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 00479F9C
                                                                                                                                                                            • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Variant$Copy$ClearInit$ErrorLast
                                                                                                                                                                          • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                                                                                                          • API String ID: 2268567065-60002521
                                                                                                                                                                          • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                                                                                          • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
                                                                                                                                                                          • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                                                                                          • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
                                                                                                                                                                          Function 00401D10 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 235COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
                                                                                                                                                                          • DestroyWindow.USER32(?), ref: 0042A751
                                                                                                                                                                          • UnregisterHotKey.USER32(?), ref: 0042A778
                                                                                                                                                                          • FreeLibrary.KERNEL32(?), ref: 0042A822
                                                                                                                                                                          • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
                                                                                                                                                                          • String ID: close all
                                                                                                                                                                          • API String ID: 4174999648-3243417748
                                                                                                                                                                          • Opcode ID: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
                                                                                                                                                                          • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
                                                                                                                                                                          • Opcode Fuzzy Hash: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
                                                                                                                                                                          • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
                                                                                                                                                                          Function 0045DB3E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 181COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CoInitialize.OLE32(00000000), ref: 0045DB99
                                                                                                                                                                          • SHGetMalloc.SHELL32(?), ref: 0045DBA8
                                                                                                                                                                          • SHGetDesktopFolder.SHELL32(?,?), ref: 0045DC38
                                                                                                                                                                          • SHBrowseForFolderW.SHELL32 ref: 0045DCF5
                                                                                                                                                                          • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0045DD13
                                                                                                                                                                          • CoUninitialize.OLE32 ref: 0045DD6B
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Folder$BrowseDesktopFromInitializeListMallocPathUninitialize
                                                                                                                                                                          • String ID: HH
                                                                                                                                                                          • API String ID: 2328888689-2761332787
                                                                                                                                                                          • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                                                                                          • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
                                                                                                                                                                          • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                                                                                          • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
                                                                                                                                                                          Function 0044AA1F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171networkCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
                                                                                                                                                                          • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
                                                                                                                                                                          • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
                                                                                                                                                                          • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
                                                                                                                                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
                                                                                                                                                                          • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
                                                                                                                                                                            • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1291720006-3916222277
                                                                                                                                                                          • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                                                                                          • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
                                                                                                                                                                          • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                                                                                          • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
                                                                                                                                                                          Function 004180A7 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 161fileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetModuleFileNameA.KERNEL32(00000000,00496789,00000104,?,00411739,?,00401C0B), ref: 0041814A
                                                                                                                                                                          • GetStdHandle.KERNEL32(000000F4,00000001,?,00000000,00000003,00000003,?,0041827E,000000FC,00418365,0048CA38,0000000C,00418422,00411739,?), ref: 0041821D
                                                                                                                                                                          • WriteFile.KERNEL32(00000000,00000000,00000000,00411739,00000000,?,0041827E,000000FC,00418365,0048CA38,0000000C,00418422,00411739,?,?,004224D3), ref: 00418247
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: File$HandleModuleNameWrite
                                                                                                                                                                          • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                                                                                                          • API String ID: 3784150691-4022980321
                                                                                                                                                                          • Opcode ID: e76ecb60561fe747eec25ea6da2aa861ca3e5a9d7f3461b9d4a94d885804126d
                                                                                                                                                                          • Instruction ID: dd0201cc8d4d8b0dfcb57b62c9b49e6d742448a59313f766a6a12cff913f25f6
                                                                                                                                                                          • Opcode Fuzzy Hash: e76ecb60561fe747eec25ea6da2aa861ca3e5a9d7f3461b9d4a94d885804126d
                                                                                                                                                                          • Instruction Fuzzy Hash: DA410AB2B0021076DA222A769D8AFFF756C9B11B54F15013FFD0591292FE6D8A8241FD
                                                                                                                                                                          Function 0045F2C5 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
                                                                                                                                                                          • IsMenu.USER32(?), ref: 0045F380
                                                                                                                                                                          • CreatePopupMenu.USER32 ref: 0045F3C5
                                                                                                                                                                          • GetMenuItemCount.USER32(?), ref: 0045F42F
                                                                                                                                                                          • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                                                                                                                                          • String ID: 0$2
                                                                                                                                                                          • API String ID: 93392585-3793063076
                                                                                                                                                                          • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                                                                                          • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
                                                                                                                                                                          • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                                                                                          • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
                                                                                                                                                                          Function 004507E7 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
                                                                                                                                                                          • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
                                                                                                                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
                                                                                                                                                                          • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
                                                                                                                                                                          • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$Window
                                                                                                                                                                          • String ID: -----$SysListView32
                                                                                                                                                                          • API String ID: 2326795674-3975388722
                                                                                                                                                                          • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                                                                                          • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
                                                                                                                                                                          • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                                                                                          • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
                                                                                                                                                                          Function 00436582 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 79networkCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • WSAStartup.WSOCK32(00000101,?), ref: 004365A5
                                                                                                                                                                          • gethostname.WSOCK32(00000100,00000100,00000101,?), ref: 004365BC
                                                                                                                                                                          • gethostbyname.WSOCK32(00000101,00000100,00000100,00000101,?), ref: 004365C6
                                                                                                                                                                          • WSACleanup.WSOCK32 ref: 004365FD
                                                                                                                                                                          • inet_ntoa.WSOCK32(00000100,?), ref: 00436624
                                                                                                                                                                          • WSACleanup.WSOCK32(?,?,?,?,?,?,00000100,?), ref: 00436652
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Cleanup$Startupgethostbynamegethostnameinet_ntoa
                                                                                                                                                                          • String ID: 0.0.0.0
                                                                                                                                                                          • API String ID: 1500336939-3771769585
                                                                                                                                                                          • Opcode ID: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
                                                                                                                                                                          • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
                                                                                                                                                                          • Opcode Fuzzy Hash: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
                                                                                                                                                                          • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
                                                                                                                                                                          Function 00416B12 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 57libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
                                                                                                                                                                          • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
                                                                                                                                                                          • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
                                                                                                                                                                            • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                                                                                                                                                                            • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AddressHandleModuleProc$IncrementInterlockedSleep
                                                                                                                                                                          • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                                                                          • API String ID: 3998264955-2843748187
                                                                                                                                                                          • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                                                                                          • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
                                                                                                                                                                          • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                                                                                          • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
                                                                                                                                                                          Function 0043717F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\Purchase Order.exe), ref: 0043719E
                                                                                                                                                                          • LoadStringW.USER32(00000000), ref: 004371A7
                                                                                                                                                                          • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
                                                                                                                                                                          • LoadStringW.USER32(00000000), ref: 004371C0
                                                                                                                                                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
                                                                                                                                                                          Strings
                                                                                                                                                                          • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
                                                                                                                                                                          • C:\Users\user\Desktop\Purchase Order.exe, xrefs: 00437189
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: HandleLoadModuleString$Message
                                                                                                                                                                          • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\Purchase Order.exe
                                                                                                                                                                          • API String ID: 4072794657-2215345310
                                                                                                                                                                          • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                                                                                          • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
                                                                                                                                                                          • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                                                                                          • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
                                                                                                                                                                          Function 00441561 Relevance: 12.1, APIs: 8, Instructions: 101windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0044157D
                                                                                                                                                                          • GetDC.USER32(00000000), ref: 00441585
                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
                                                                                                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 0044159B
                                                                                                                                                                          • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
                                                                                                                                                                          • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
                                                                                                                                                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
                                                                                                                                                                          • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3864802216-0
                                                                                                                                                                          • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                                                                                          • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
                                                                                                                                                                          • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                                                                                          • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
                                                                                                                                                                          Function 0046ECBF Relevance: 12.1, APIs: 8, Instructions: 101COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: InitVariant
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1927566239-0
                                                                                                                                                                          • Opcode ID: afb533e23b19910be0c027df8fa87fd227b592e7e5a0e6e969ae1a59b8da4157
                                                                                                                                                                          • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
                                                                                                                                                                          • Opcode Fuzzy Hash: afb533e23b19910be0c027df8fa87fd227b592e7e5a0e6e969ae1a59b8da4157
                                                                                                                                                                          • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
                                                                                                                                                                          Function 00417C37 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • InterlockedDecrement.KERNEL32(00000000), ref: 00417C51
                                                                                                                                                                          • InterlockedDecrement.KERNEL32(?), ref: 00417C5E
                                                                                                                                                                          • InterlockedDecrement.KERNEL32(?), ref: 00417C6B
                                                                                                                                                                          • InterlockedDecrement.KERNEL32(?), ref: 00417C78
                                                                                                                                                                          • InterlockedDecrement.KERNEL32(?), ref: 00417C85
                                                                                                                                                                          • InterlockedDecrement.KERNEL32(?), ref: 00417CA1
                                                                                                                                                                          • InterlockedDecrement.KERNEL32(?), ref: 00417CB1
                                                                                                                                                                          • InterlockedDecrement.KERNEL32(?), ref: 00417CC7
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: DecrementInterlocked
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3448037634-0
                                                                                                                                                                          • Opcode ID: e3e593b2512a4258f70d79ada8771ba765959c03c41681832578354204dfbbb8
                                                                                                                                                                          • Instruction ID: a6556518ad8db110cb1b00e702d9e0698ae62f30edd3f87937ee49336a9ec4f3
                                                                                                                                                                          • Opcode Fuzzy Hash: e3e593b2512a4258f70d79ada8771ba765959c03c41681832578354204dfbbb8
                                                                                                                                                                          • Instruction Fuzzy Hash: ED11FE71B04615A7DB109B69DD84B97B7ADAF40741F084417A808D7340EB78E9908BE8
                                                                                                                                                                          Function 004357AD Relevance: 12.0, APIs: 8, Instructions: 36COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • VariantClear.OLEAUT32(00000038), ref: 004357C3
                                                                                                                                                                          • VariantClear.OLEAUT32(00000058), ref: 004357C9
                                                                                                                                                                          • VariantClear.OLEAUT32(00000068), ref: 004357CF
                                                                                                                                                                          • VariantClear.OLEAUT32(00000078), ref: 004357D5
                                                                                                                                                                          • VariantClear.OLEAUT32(00000088), ref: 004357DE
                                                                                                                                                                          • VariantClear.OLEAUT32(00000048), ref: 004357E4
                                                                                                                                                                          • VariantClear.OLEAUT32(00000098), ref: 004357ED
                                                                                                                                                                          • VariantClear.OLEAUT32(000000A8), ref: 004357F6
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ClearVariant
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1473721057-0
                                                                                                                                                                          • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                                                                                          • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
                                                                                                                                                                          • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                                                                                          • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
                                                                                                                                                                          Function 00440B39 Relevance: 10.8, APIs: 7, Instructions: 261COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MetricsSystem
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 4116985748-0
                                                                                                                                                                          • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                                                                                          • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
                                                                                                                                                                          • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                                                                                          • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
                                                                                                                                                                          Function 0046AB70 Relevance: 10.8, APIs: 7, Instructions: 260registryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ConnectRegistry
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 76216097-0
                                                                                                                                                                          • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                                                                                          • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
                                                                                                                                                                          • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                                                                                          • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
                                                                                                                                                                          Function 0047395A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
                                                                                                                                                                          • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
                                                                                                                                                                          • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                                                                                                          • String ID: HH
                                                                                                                                                                          • API String ID: 3488606520-2761332787
                                                                                                                                                                          • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                                                                                          • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
                                                                                                                                                                          • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                                                                                          • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
                                                                                                                                                                          Function 004472C8 Relevance: 10.7, APIs: 7, Instructions: 207COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                            • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                            • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                          • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                                                                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                                                                                          • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                                                                                          • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                                                                                          • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                                                                                          • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                                                                                          • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 4082120231-0
                                                                                                                                                                          • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                                                                                          • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
                                                                                                                                                                          • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                                                                                          • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
                                                                                                                                                                          Function 00447303 Relevance: 10.7, APIs: 7, Instructions: 192COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                            • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                            • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                          • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                                                                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                                                                                          • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                                                                                          • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                                                                                          • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                                                                                          • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                                                                                          • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 4082120231-0
                                                                                                                                                                          • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                                                                                          • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
                                                                                                                                                                          • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                                                                                          • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
                                                                                                                                                                          Function 0044733D Relevance: 10.7, APIs: 7, Instructions: 177COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 288456094-0
                                                                                                                                                                          • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                                                                                          • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
                                                                                                                                                                          • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                                                                                          • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
                                                                                                                                                                          Function 0042540D Relevance: 10.7, APIs: 7, Instructions: 175COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetCPInfo.KERNEL32(00000000,?,00000000,00000001,00000000,?,?,?,0041D4AE,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00425458
                                                                                                                                                                          • GetCPInfo.KERNEL32(00000000,00000001,?,?,?,0041D4AE,00000000,00000000,?), ref: 00425471
                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000100,00000001,0041D4AE,00000000,00000000,00000000,?,?,?,0041D4AE,00000000,00000000,?,?,00000000,00000000), ref: 004254CF
                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000100,00000001,0041D4AE,00000000,?,00000000,?,?,?,?,?,?,0041D4AE,00000000,00000000,?), ref: 0042551E
                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,0041D4AE,00000000), ref: 00425539
                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,0041D4AE,00000000), ref: 0042555F
                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,0041D4AE,00000000), ref: 00425584
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ByteCharMultiWide$Info
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1775632426-0
                                                                                                                                                                          • Opcode ID: 691f6279820d20f455e7befef3e0fcba74c582925611e7755a6e8405b10c4f55
                                                                                                                                                                          • Instruction ID: cfbbdbeff2fc93c5700b589297128cc5131deecd4fa0efd2065aadc2599a9f50
                                                                                                                                                                          • Opcode Fuzzy Hash: 691f6279820d20f455e7befef3e0fcba74c582925611e7755a6e8405b10c4f55
                                                                                                                                                                          • Instruction Fuzzy Hash: F351A231E00628AFCF219F95EC44DEFBBB5EF88311F60011AF914A2250D3398D81CB68
                                                                                                                                                                          Function 0046BB59 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 168networkCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ErrorLastselect
                                                                                                                                                                          • String ID: HH
                                                                                                                                                                          • API String ID: 215497628-2761332787
                                                                                                                                                                          • Opcode ID: 8403caabb69194ab749b3558b6d17cf16ba223cf5fbe2e3d1d341ca8c1bfc534
                                                                                                                                                                          • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
                                                                                                                                                                          • Opcode Fuzzy Hash: 8403caabb69194ab749b3558b6d17cf16ba223cf5fbe2e3d1d341ca8c1bfc534
                                                                                                                                                                          • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
                                                                                                                                                                          Function 0044496C Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetParent.USER32(?), ref: 004449B0
                                                                                                                                                                          • GetKeyboardState.USER32(?), ref: 004449C3
                                                                                                                                                                          • SetKeyboardState.USER32(?), ref: 00444A0F
                                                                                                                                                                          • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
                                                                                                                                                                          • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
                                                                                                                                                                          • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
                                                                                                                                                                          • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 87235514-0
                                                                                                                                                                          • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                                                                                          • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
                                                                                                                                                                          • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                                                                                          • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
                                                                                                                                                                          Function 00444B65 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetParent.USER32(?), ref: 00444BA9
                                                                                                                                                                          • GetKeyboardState.USER32(?), ref: 00444BBC
                                                                                                                                                                          • SetKeyboardState.USER32(?), ref: 00444C08
                                                                                                                                                                          • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
                                                                                                                                                                          • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
                                                                                                                                                                          • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
                                                                                                                                                                          • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 87235514-0
                                                                                                                                                                          • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                                                                                          • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
                                                                                                                                                                          • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                                                                                          • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
                                                                                                                                                                          Function 004498BD Relevance: 10.7, APIs: 7, Instructions: 159COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                                                                                          • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
                                                                                                                                                                          • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                                                                                          • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
                                                                                                                                                                          Function 0046A98D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158registryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ConnectRegistry
                                                                                                                                                                          • String ID: HH
                                                                                                                                                                          • API String ID: 76216097-2761332787
                                                                                                                                                                          • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                                                                                          • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
                                                                                                                                                                          • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                                                                                          • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
                                                                                                                                                                          Function 00455297 Relevance: 10.6, APIs: 7, Instructions: 149windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
                                                                                                                                                                          • ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
                                                                                                                                                                          • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2354583917-0
                                                                                                                                                                          • Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                                                                                          • Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
                                                                                                                                                                          • Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                                                                                          • Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54
                                                                                                                                                                          Function 00448877 Relevance: 10.6, APIs: 7, Instructions: 130windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
                                                                                                                                                                          • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$Enable$Show$MessageMoveSend
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 896007046-0
                                                                                                                                                                          • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                                                                                          • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
                                                                                                                                                                          • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                                                                                          • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
                                                                                                                                                                          Function 004413F0 Relevance: 10.6, APIs: 7, Instructions: 114windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                                                                                          • SendMessageW.USER32(03411A90,000000F1,00000000,00000000), ref: 004414C6
                                                                                                                                                                          • SendMessageW.USER32(03411A90,000000F1,00000001,00000000), ref: 004414F1
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$LongWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 312131281-0
                                                                                                                                                                          • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                                                                                          • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
                                                                                                                                                                          • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                                                                                          • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
                                                                                                                                                                          Function 0047244D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104sleepCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • InterlockedIncrement.KERNEL32 ref: 0047247C
                                                                                                                                                                          • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
                                                                                                                                                                          • Sleep.KERNEL32(0000000A), ref: 00472499
                                                                                                                                                                          • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
                                                                                                                                                                          • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Interlocked$DecrementIncrement$Sleep
                                                                                                                                                                          • String ID: 0vH
                                                                                                                                                                          • API String ID: 327565842-3662162768
                                                                                                                                                                          • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                                                                                          • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
                                                                                                                                                                          • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                                                                                          • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
                                                                                                                                                                          Function 00448AFF Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
                                                                                                                                                                          • GetFocus.USER32 ref: 00448B1C
                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$Enable$Show$FocusMessageSend
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3429747543-0
                                                                                                                                                                          • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                                                                                          • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
                                                                                                                                                                          • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                                                                                          • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
                                                                                                                                                                          Function 00450DB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450E24
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450E35
                                                                                                                                                                          • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450E43
                                                                                                                                                                          • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450E54
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450E62
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                          • String ID: Msctls_Progress32
                                                                                                                                                                          • API String ID: 3850602802-3636473452
                                                                                                                                                                          • Opcode ID: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                                                                                          • Instruction ID: b51c377fab27852337593a8f268aff884918310fa347e0537580fa9f3b853d23
                                                                                                                                                                          • Opcode Fuzzy Hash: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                                                                                          • Instruction Fuzzy Hash: 2C2121712543007AE7209A65DC42F5BB3E9AFD8B24F214A0EF754B72D1C6B4F8418B58
                                                                                                                                                                          Function 00455449 Relevance: 10.6, APIs: 7, Instructions: 75windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 00455451
                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0045545F
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Destroy$DeleteImageList_ObjectWindow$Icon
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3985565216-0
                                                                                                                                                                          • Opcode ID: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                                                                                          • Instruction ID: 02eb1b45cc7e926b76574f27881fb1e8d9d372094f4d7b34cf8607babd6cb63d
                                                                                                                                                                          • Opcode Fuzzy Hash: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                                                                                          • Instruction Fuzzy Hash: EA213270200A019FCB20DF65CAD4B2A77A9BF45312F50855EED45CB352DB39EC45CB69
                                                                                                                                                                          Function 00439102 Relevance: 10.5, APIs: 7, Instructions: 46threadCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
                                                                                                                                                                            • Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF
                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
                                                                                                                                                                          • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
                                                                                                                                                                          • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
                                                                                                                                                                          • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1957940570-0
                                                                                                                                                                          • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                                                                                          • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
                                                                                                                                                                          • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                                                                                          • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
                                                                                                                                                                          Function 0041696E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • TlsGetValue.KERNEL32(00000000,?,004169E7,00000000,00422F48,00496770,00000000,00000314,?,00418216,00496770,Microsoft Visual C++ Runtime Library,00012010), ref: 00416980
                                                                                                                                                                          • TlsGetValue.KERNEL32(00000005,?,004169E7,00000000,00422F48,00496770,00000000,00000314,?,00418216,00496770,Microsoft Visual C++ Runtime Library,00012010), ref: 00416997
                                                                                                                                                                          • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004169E7,00000000,00422F48,00496770,00000000,00000314,?,00418216,00496770,Microsoft Visual C++ Runtime Library,00012010), ref: 004169AD
                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004169C8
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Value$AddressHandleModuleProc
                                                                                                                                                                          • String ID: EncodePointer$KERNEL32.DLL
                                                                                                                                                                          • API String ID: 1929421221-3682587211
                                                                                                                                                                          • Opcode ID: f1787378902819e9947f97c0fd6b8d9b320c13b2552bb88f8caa1f2ac1665e6d
                                                                                                                                                                          • Instruction ID: e5bba5b00aa6f8354d24bce9220d26f317535e3d8edc7be22519ce0301cf3cdb
                                                                                                                                                                          • Opcode Fuzzy Hash: f1787378902819e9947f97c0fd6b8d9b320c13b2552bb88f8caa1f2ac1665e6d
                                                                                                                                                                          • Instruction Fuzzy Hash: 4CF0C2B0210111AF8F209B35DD449EF3A98AF403657064437FC1DD62A0DB38DC81C79D
                                                                                                                                                                          Function 004169E9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • TlsGetValue.KERNEL32(00411739,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 004169FB
                                                                                                                                                                          • TlsGetValue.KERNEL32(00000005,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00416A12
                                                                                                                                                                          • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00416A28
                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00416A43
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Value$AddressHandleModuleProc
                                                                                                                                                                          • String ID: DecodePointer$KERNEL32.DLL
                                                                                                                                                                          • API String ID: 1929421221-629428536
                                                                                                                                                                          • Opcode ID: 0b3d26fac8f7b222a059dde4d81d242a9bd92865164bd8a543a794d3b2e1d27d
                                                                                                                                                                          • Instruction ID: 6b6853f7d3ee3eb9e65f39b7335b34cb1b7d5f0f3521d7c85aee421bb533db53
                                                                                                                                                                          • Opcode Fuzzy Hash: 0b3d26fac8f7b222a059dde4d81d242a9bd92865164bd8a543a794d3b2e1d27d
                                                                                                                                                                          • Instruction Fuzzy Hash: 65F04430600115AB8B209B75DD44ADF3F99AF423E0715843BFC18E62A0EB38DD41879C
                                                                                                                                                                          Function 00434124 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                          • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
                                                                                                                                                                          • API String ID: 2574300362-3261711971
                                                                                                                                                                          • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                                                                                          • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
                                                                                                                                                                          • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                                                                                          • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
                                                                                                                                                                          Function 0047B1D0 Relevance: 9.5, APIs: 6, Instructions: 489COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                                                                                          • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
                                                                                                                                                                          • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                                                                                          • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
                                                                                                                                                                          Function 00464A0E Relevance: 9.3, APIs: 6, Instructions: 281networkmemoryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • WSAStartup.WSOCK32(00000101,?,?), ref: 00464ADE
                                                                                                                                                                            • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                                                                                          • inet_addr.WSOCK32(?,00000000,?,?,00000101,?,?), ref: 00464B1F
                                                                                                                                                                          • gethostbyname.WSOCK32(?,?,00000000,?,?,00000101,?,?), ref: 00464B29
                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
                                                                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 00464CDE
                                                                                                                                                                          • WSACleanup.WSOCK32 ref: 00464CE4
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Global$AllocByteCharCleanupFreeMultiStartupWidegethostbynameinet_addr
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 867222529-0
                                                                                                                                                                          • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                                                                                          • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
                                                                                                                                                                          • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                                                                                          • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
                                                                                                                                                                          Function 004336C7 Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 00433724
                                                                                                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00433757
                                                                                                                                                                          • GetClientRect.USER32(0000001D,?), ref: 004337AC
                                                                                                                                                                          • GetSystemMetrics.USER32(0000000F), ref: 00433800
                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00433814
                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00433842
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Rect$Client$Window$MetricsScreenSystem
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3220332590-0
                                                                                                                                                                          • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                                                                                          • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
                                                                                                                                                                          • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                                                                                          • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
                                                                                                                                                                          Function 00422806 Relevance: 9.2, APIs: 6, Instructions: 166COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetStringTypeW.KERNEL32(00000001,004832AC,00000001,?,00000000,00000100,00000000,?,?,?,004229F0,00000001,?,?,?,?), ref: 00422835
                                                                                                                                                                          • GetLastError.KERNEL32(?,004229F0,00000001,?,?,?,?,?,?,?,?,00000001,?,?,?,00000001), ref: 00422847
                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000100,00000000,?,?,?,004229F0,00000001,?,?), ref: 004228AC
                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,?,?,00000001,?,?,?,00000001,?), ref: 00422916
                                                                                                                                                                          • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00422924
                                                                                                                                                                          • GetStringTypeA.KERNEL32(?,?,?,?,?,00000000,00000100,00000000,?,?,?,004229F0,00000001,?,?,?), ref: 00422999
                                                                                                                                                                            • Part of subcall function 0042540D: GetCPInfo.KERNEL32(00000000,?,00000000,00000001,00000000,?,?,?,0041D4AE,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00425458
                                                                                                                                                                            • Part of subcall function 0042540D: GetCPInfo.KERNEL32(00000000,00000001,?,?,?,0041D4AE,00000000,00000000,?), ref: 00425471
                                                                                                                                                                            • Part of subcall function 0042540D: MultiByteToWideChar.KERNEL32(00000100,00000001,0041D4AE,00000000,?,00000000,?,?,?,?,?,?,0041D4AE,00000000,00000000,?), ref: 0042551E
                                                                                                                                                                            • Part of subcall function 0042540D: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,0041D4AE,00000000), ref: 00425539
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ByteCharMultiWide$StringType$Info$ErrorLast
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2250435928-0
                                                                                                                                                                          • Opcode ID: 773a929a23efa12b5da778aefeae380a86b05995ea6eda526da0bbf57dde95d5
                                                                                                                                                                          • Instruction ID: 0f324d561209b13029d01e9070866e268b39bf3e2f15ac4abc19e924a9dc5289
                                                                                                                                                                          • Opcode Fuzzy Hash: 773a929a23efa12b5da778aefeae380a86b05995ea6eda526da0bbf57dde95d5
                                                                                                                                                                          • Instruction Fuzzy Hash: E751A27170022ABFDF10AF64ED819AF3BA9FB04754F90052BF910D6250D6B9CDA0DB98
                                                                                                                                                                          Function 0044C522 Relevance: 9.2, APIs: 6, Instructions: 155windowkeyboardCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
                                                                                                                                                                          • SetKeyboardState.USER32(00000080), ref: 0044C59B
                                                                                                                                                                          • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
                                                                                                                                                                          • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
                                                                                                                                                                          • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
                                                                                                                                                                          • SendInput.USER32 ref: 0044C6E2
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessagePost$KeyboardState$InputSend
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2221674350-0
                                                                                                                                                                          • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                                                                                          • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
                                                                                                                                                                          • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                                                                                          • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
                                                                                                                                                                          Function 0047762A Relevance: 9.1, APIs: 6, Instructions: 140windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                          • GetMenu.USER32 ref: 004776AA
                                                                                                                                                                          • GetMenuItemCount.USER32(00000000), ref: 004776CC
                                                                                                                                                                          • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Menu$CountItemStringWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2847105600-0
                                                                                                                                                                          • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                                                                                          • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
                                                                                                                                                                          • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                                                                                          • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
                                                                                                                                                                          Function 00447B66 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                                                                                          • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                                                                                          • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                                                                                          • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 4189319755-0
                                                                                                                                                                          • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                                                                                          • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
                                                                                                                                                                          • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                                                                                          • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
                                                                                                                                                                          Function 0044B474 Relevance: 9.1, APIs: 6, Instructions: 113fileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
                                                                                                                                                                          • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
                                                                                                                                                                          • EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
                                                                                                                                                                          • LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
                                                                                                                                                                          • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
                                                                                                                                                                          • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3368777196-0
                                                                                                                                                                          • Opcode ID: 16d5c57b5e53c2061fc4ac4ded6e87df9b6247511e9ffc13c2dfc8627616166f
                                                                                                                                                                          • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
                                                                                                                                                                          • Opcode Fuzzy Hash: 16d5c57b5e53c2061fc4ac4ded6e87df9b6247511e9ffc13c2dfc8627616166f
                                                                                                                                                                          • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
                                                                                                                                                                          Function 00441077 Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
                                                                                                                                                                          • EnableWindow.USER32(?,00000000), ref: 0044111A
                                                                                                                                                                          • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
                                                                                                                                                                          • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
                                                                                                                                                                          • EnableWindow.USER32(?,00000001), ref: 004411B3
                                                                                                                                                                          • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$Show$Enable$MessageSend
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 642888154-0
                                                                                                                                                                          • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                                                                                          • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
                                                                                                                                                                          • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                                                                                          • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
                                                                                                                                                                          Function 00449063 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
                                                                                                                                                                          • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
                                                                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
                                                                                                                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
                                                                                                                                                                          • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$LongWindow$InvalidateRect
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1976402638-0
                                                                                                                                                                          • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                                                                                          • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
                                                                                                                                                                          • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                                                                                          • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
                                                                                                                                                                          Function 00442582 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 00442597
                                                                                                                                                                            • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 004425BF
                                                                                                                                                                          • GetWindowRect.USER32(00000000), ref: 004425C6
                                                                                                                                                                          • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
                                                                                                                                                                            • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 00442624
                                                                                                                                                                          • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 4137160315-0
                                                                                                                                                                          • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                                                                                          • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
                                                                                                                                                                          • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                                                                                          • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
                                                                                                                                                                          Function 00448851 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$Enable$Show$MessageSend
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1871949834-0
                                                                                                                                                                          • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                                                                                          • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
                                                                                                                                                                          • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                                                                                          • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
                                                                                                                                                                          Function 004416D1 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                                                                                          • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
                                                                                                                                                                          • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                                                                                          • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
                                                                                                                                                                          Function 0045552E Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: DestroyWindow$DeleteObject$IconMove
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1640429340-0
                                                                                                                                                                          • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                                                                                          • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
                                                                                                                                                                          • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                                                                                          • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
                                                                                                                                                                          Function 00455080 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Destroy$DeleteMenuObject$IconWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 752480666-0
                                                                                                                                                                          • Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                                                                                          • Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
                                                                                                                                                                          • Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                                                                                          • Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59
                                                                                                                                                                          Function 00455212 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DestroyWindow.USER32(00000000), ref: 0045527A
                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0045528C
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3275902921-0
                                                                                                                                                                          • Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                                                                                          • Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
                                                                                                                                                                          • Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                                                                                          • Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68
                                                                                                                                                                          Function 00439326 Relevance: 9.1, APIs: 6, Instructions: 72processCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
                                                                                                                                                                          • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
                                                                                                                                                                          • CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
                                                                                                                                                                          • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
                                                                                                                                                                          • DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1413079979-0
                                                                                                                                                                          • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                                                                                          • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
                                                                                                                                                                          • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                                                                                          • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
                                                                                                                                                                          Function 004555E0 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 004555E8
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3275902921-0
                                                                                                                                                                          • Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                                                                                          • Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
                                                                                                                                                                          • Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                                                                                          • Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59
                                                                                                                                                                          Function 004554C0 Relevance: 9.1, APIs: 6, Instructions: 61windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32 ref: 004554DF
                                                                                                                                                                          • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: DeleteDestroyMessageObjectSend$IconWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3691411573-0
                                                                                                                                                                          • Opcode ID: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                                                                                          • Instruction ID: ead105b7aa3a144aa2df3f4c31681f961a0d6b706109639263d1a652a664e8ec
                                                                                                                                                                          • Opcode Fuzzy Hash: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                                                                                          • Instruction Fuzzy Hash: A5118F713046419BDB10DF68DD88A2A77A8FB58322F404A2AFE14DB2D1D775DC498B68
                                                                                                                                                                          Function 00436272 Relevance: 9.1, APIs: 6, Instructions: 59sleepCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
                                                                                                                                                                          • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2833360925-0
                                                                                                                                                                          • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                                                                                          • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
                                                                                                                                                                          • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                                                                                          • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
                                                                                                                                                                          Function 004471EC Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                            • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                            • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
                                                                                                                                                                          • LineTo.GDI32(?,?,?), ref: 00447227
                                                                                                                                                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
                                                                                                                                                                          • LineTo.GDI32(?,?,?), ref: 0044723D
                                                                                                                                                                          • EndPath.GDI32(?), ref: 0044724E
                                                                                                                                                                          • StrokePath.GDI32(?), ref: 0044725C
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 372113273-0
                                                                                                                                                                          • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                                                                                          • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
                                                                                                                                                                          • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                                                                                          • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
                                                                                                                                                                          Function 00410940 Relevance: 9.0, APIs: 6, Instructions: 49keyboardCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
                                                                                                                                                                          • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
                                                                                                                                                                          • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
                                                                                                                                                                          • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
                                                                                                                                                                          • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Virtual
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 4278518827-0
                                                                                                                                                                          • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                                                                                          • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
                                                                                                                                                                          • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                                                                                          • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
                                                                                                                                                                          Function 0044CBD3 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetDC.USER32(00000000), ref: 0044CBEF
                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC00
                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC09
                                                                                                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 0044CC10
                                                                                                                                                                          • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CC29
                                                                                                                                                                          • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0044CC37
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CapsDevice$Release
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1035833867-0
                                                                                                                                                                          • Opcode ID: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                                                                                          • Instruction ID: 50bf861fd692b93b916a63282857a41227f0dfa19545bc4f0a59f576ae553c11
                                                                                                                                                                          • Opcode Fuzzy Hash: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                                                                                          • Instruction Fuzzy Hash: 560184B1641314BFF6009BA1DC4AF1BBB9CEF55755F01842EFF44A7241D6B098008BA9
                                                                                                                                                                          Function 0044B64F Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
                                                                                                                                                                          • EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
                                                                                                                                                                          • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
                                                                                                                                                                          • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
                                                                                                                                                                            • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
                                                                                                                                                                          • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
                                                                                                                                                                          • LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3495660284-0
                                                                                                                                                                          • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                                                                                          • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
                                                                                                                                                                          • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                                                                                          • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
                                                                                                                                                                          Function 00437118 Relevance: 9.0, APIs: 6, Instructions: 37windowtimethreadCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
                                                                                                                                                                          • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
                                                                                                                                                                          • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
                                                                                                                                                                          • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
                                                                                                                                                                          • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00437174
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 839392675-0
                                                                                                                                                                          • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                                                                                          • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
                                                                                                                                                                          • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                                                                                          • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
                                                                                                                                                                          Function 0043604B Relevance: 9.0, APIs: 6, Instructions: 33serviceCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\Purchase Order.exe,00000004), ref: 00436055
                                                                                                                                                                          • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
                                                                                                                                                                          • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
                                                                                                                                                                          • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00436081
                                                                                                                                                                          • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1690418490-0
                                                                                                                                                                          • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                                                                                          • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
                                                                                                                                                                          • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                                                                                          • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
                                                                                                                                                                          Function 00475ACA Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 237comCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CoInitialize.OLE32(00000000), ref: 00475B71
                                                                                                                                                                          • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
                                                                                                                                                                          • CoUninitialize.OLE32 ref: 00475D71
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CreateInitializeInstanceUninitialize
                                                                                                                                                                          • String ID: .lnk$HH
                                                                                                                                                                          • API String ID: 948891078-3121654589
                                                                                                                                                                          • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                                                                                          • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
                                                                                                                                                                          • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                                                                                          • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
                                                                                                                                                                          Function 0044849C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
                                                                                                                                                                          • IsMenu.USER32(?), ref: 0044857B
                                                                                                                                                                          • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
                                                                                                                                                                          • DrawMenuBar.USER32 ref: 004485E4
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Menu$Item$DrawInfoInsert
                                                                                                                                                                          • String ID: 0
                                                                                                                                                                          • API String ID: 3076010158-4108050209
                                                                                                                                                                          • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                                                                                          • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
                                                                                                                                                                          • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                                                                                          • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
                                                                                                                                                                          Function 004692E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
                                                                                                                                                                          • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
                                                                                                                                                                          • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                          • API String ID: 3850602802-1403004172
                                                                                                                                                                          • Opcode ID: 61f9ca9c5a419efdf5b0fec418701a37d71c48c53c791e94f016d44e45ec48a7
                                                                                                                                                                          • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
                                                                                                                                                                          • Opcode Fuzzy Hash: 61f9ca9c5a419efdf5b0fec418701a37d71c48c53c791e94f016d44e45ec48a7
                                                                                                                                                                          • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
                                                                                                                                                                          Function 004366BE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetFileAttributesW.KERNEL32(?), ref: 00436700
                                                                                                                                                                          • GetLastError.KERNEL32 ref: 0043670F
                                                                                                                                                                          • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
                                                                                                                                                                            • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CreateDirectory$AttributesErrorFileLast
                                                                                                                                                                          • String ID: \
                                                                                                                                                                          • API String ID: 2267087916-2967466578
                                                                                                                                                                          • Opcode ID: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
                                                                                                                                                                          • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
                                                                                                                                                                          • Opcode Fuzzy Hash: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
                                                                                                                                                                          • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
                                                                                                                                                                          Function 00443981 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetStdHandle.KERNEL32(?), ref: 004439B4
                                                                                                                                                                            • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,77A62EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                                                                                            • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                                                                                            • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CurrentHandleProcess$Duplicate
                                                                                                                                                                          • String ID: nul
                                                                                                                                                                          • API String ID: 2124370227-2873401336
                                                                                                                                                                          • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                                                                                          • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
                                                                                                                                                                          • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                                                                                          • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
                                                                                                                                                                          Function 00443887 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
                                                                                                                                                                            • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,77A62EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                                                                                            • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                                                                                            • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CurrentHandleProcess$Duplicate
                                                                                                                                                                          • String ID: nul
                                                                                                                                                                          • API String ID: 2124370227-2873401336
                                                                                                                                                                          • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                                                                                          • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
                                                                                                                                                                          • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                                                                                          • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
                                                                                                                                                                          Function 004412AE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowlibraryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
                                                                                                                                                                          • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
                                                                                                                                                                          • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
                                                                                                                                                                          • DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                                                                                                                          • String ID: SysAnimate32
                                                                                                                                                                          • API String ID: 3529120543-1011021900
                                                                                                                                                                          • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                                                                                          • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
                                                                                                                                                                          • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                                                                                          • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
                                                                                                                                                                          Function 00443009 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
                                                                                                                                                                          • TranslateMessage.USER32(?), ref: 0044308B
                                                                                                                                                                          • DispatchMessageW.USER32(?), ref: 00443096
                                                                                                                                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Message$Peek$DispatchTranslate
                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                          • API String ID: 1795658109-438819550
                                                                                                                                                                          • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                                                                                          • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
                                                                                                                                                                          • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                                                                                          • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
                                                                                                                                                                          Function 0045D321 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 81COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
                                                                                                                                                                          • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
                                                                                                                                                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ErrorMode$InformationVolume
                                                                                                                                                                          • String ID: %lu$HH
                                                                                                                                                                          • API String ID: 2507767853-3924996404
                                                                                                                                                                          • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                                                                                          • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
                                                                                                                                                                          • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                                                                                          • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
                                                                                                                                                                          Function 00452788 Relevance: 7.8, APIs: 5, Instructions: 344COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                                                                                          • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
                                                                                                                                                                          • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                                                                                          • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
                                                                                                                                                                          Function 00421CAB Relevance: 7.7, APIs: 5, Instructions: 214COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000001,00000000,?), ref: 00421E57
                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000000,00000000,?,-00000001,?,?,00000000,?,00415F8A,00000000,?), ref: 00421ED0
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ByteCharMultiWide
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 626452242-0
                                                                                                                                                                          • Opcode ID: 1ea55d7c848440a8403a6ff58c98b5aa76672f86defd2e698422c6d464e36b7c
                                                                                                                                                                          • Instruction ID: bd3898d71cbd482aa4aa0b4c35bbdddb761c1f54cbd41572929d464e4e701234
                                                                                                                                                                          • Opcode Fuzzy Hash: 1ea55d7c848440a8403a6ff58c98b5aa76672f86defd2e698422c6d464e36b7c
                                                                                                                                                                          • Instruction Fuzzy Hash: 1371BF71A0026ADFCF20DF94EC808BFB7B5FB65314B95052BE521A7260D7349D81CB69
                                                                                                                                                                          Function 0041B669 Relevance: 7.7, APIs: 5, Instructions: 190COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetStartupInfoA.KERNEL32(?), ref: 0041B67E
                                                                                                                                                                            • Part of subcall function 00416FFB: Sleep.KERNEL32(00000000,?,00411739,?,00401C0B), ref: 00417023
                                                                                                                                                                          • GetFileType.KERNEL32(00000040), ref: 0041B7A8
                                                                                                                                                                          • GetStdHandle.KERNEL32(-000000F6), ref: 0041B832
                                                                                                                                                                          • GetFileType.KERNEL32(00000000), ref: 0041B844
                                                                                                                                                                          • SetHandleCount.KERNEL32 ref: 0041B89C
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: FileHandleType$CountInfoSleepStartup
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1302456922-0
                                                                                                                                                                          • Opcode ID: 042631592d203edaaf3f4d78f5e16ed03b675539f236fb7f0781e26425fee0e7
                                                                                                                                                                          • Instruction ID: 78394165c801ef16868fb9e1c6e049db50f2448aaa9d77fd502763510830d482
                                                                                                                                                                          • Opcode Fuzzy Hash: 042631592d203edaaf3f4d78f5e16ed03b675539f236fb7f0781e26425fee0e7
                                                                                                                                                                          • Instruction Fuzzy Hash: 4E7124715047418FDB209B28C8847AABBF0EF46724F29465ED4A59B3E1C77CD882CB99
                                                                                                                                                                          Function 00463D7E Relevance: 7.6, APIs: 5, Instructions: 141libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?), ref: 00463E68
                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AddressProc$Library$FreeLoad
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2449869053-0
                                                                                                                                                                          • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                                                                                          • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
                                                                                                                                                                          • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                                                                                          • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
                                                                                                                                                                          Function 0044C379 Relevance: 7.6, APIs: 5, Instructions: 137windowkeyboardCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
                                                                                                                                                                          • SetKeyboardState.USER32(00000080), ref: 0044C3ED
                                                                                                                                                                          • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
                                                                                                                                                                          • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
                                                                                                                                                                          • SendInput.USER32 ref: 0044C509
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: KeyboardMessagePostState$InputSend
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3031425849-0
                                                                                                                                                                          • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                                                                                          • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
                                                                                                                                                                          • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                                                                                          • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
                                                                                                                                                                          Function 004422B9 Relevance: 7.6, APIs: 5, Instructions: 108registryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • RegEnumKeyExW.ADVAPI32 ref: 004422F0
                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
                                                                                                                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
                                                                                                                                                                          • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
                                                                                                                                                                          • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Enum$CloseDeleteOpen
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2095303065-0
                                                                                                                                                                          • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                                                                                          • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
                                                                                                                                                                          • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                                                                                          • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
                                                                                                                                                                          Function 0045C277 Relevance: 7.6, APIs: 5, Instructions: 105COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
                                                                                                                                                                          • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
                                                                                                                                                                          • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
                                                                                                                                                                          • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
                                                                                                                                                                          • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: PrivateProfile$SectionWrite$String
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2832842796-0
                                                                                                                                                                          • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                                                                                          • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
                                                                                                                                                                          • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                                                                                          • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
                                                                                                                                                                          Function 0044796B Relevance: 7.6, APIs: 5, Instructions: 96COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 00447997
                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 004479A2
                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 004479BE
                                                                                                                                                                          • WindowFromPoint.USER32(?,?), ref: 004479FF
                                                                                                                                                                          • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447A78
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Client$CursorFromPointProcRectScreenWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1822080540-0
                                                                                                                                                                          • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                                                                                          • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
                                                                                                                                                                          • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                                                                                          • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
                                                                                                                                                                          Function 00447BAF Relevance: 7.6, APIs: 5, Instructions: 95COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                                                                                          • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                                                                                          • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                                                                                          • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ClientPaintRectRectangleScreenViewportWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 659298297-0
                                                                                                                                                                          • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                                                                                          • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
                                                                                                                                                                          • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                                                                                          • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
                                                                                                                                                                          Function 00447870 Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 004478A7
                                                                                                                                                                          • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
                                                                                                                                                                          • DefDlgProcW.USER32(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 00447935
                                                                                                                                                                          • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CursorMenuPopupTrack$Proc
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1300944170-0
                                                                                                                                                                          • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                                                                                          • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
                                                                                                                                                                          • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                                                                                          • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
                                                                                                                                                                          Function 00448837 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                            • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                                                                                            • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                                                                                            • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                                                                                            • Part of subcall function 004413F0: SendMessageW.USER32(03411A90,000000F1,00000000,00000000), ref: 004414C6
                                                                                                                                                                            • Part of subcall function 004413F0: SendMessageW.USER32(03411A90,000000F1,00000001,00000000), ref: 004414F1
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$EnableMessageSend$LongShow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 142311417-0
                                                                                                                                                                          • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                                                                                          • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
                                                                                                                                                                          • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                                                                                          • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
                                                                                                                                                                          Function 00455014 Relevance: 7.6, APIs: 5, Instructions: 78COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID:
                                                                                                                                                                          • Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                                                                                          • Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
                                                                                                                                                                          • Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                                                                                          • Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9
                                                                                                                                                                          Function 00459DCF Relevance: 7.6, APIs: 5, Instructions: 71COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • IsWindow.USER32(00000000), ref: 00459DEF
                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 00459E07
                                                                                                                                                                          • GetDC.USER32(00000000), ref: 00459E44
                                                                                                                                                                          • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
                                                                                                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 00459E8B
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$ForegroundPixelRelease
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 4156661090-0
                                                                                                                                                                          • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                                                                                          • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
                                                                                                                                                                          • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                                                                                          • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
                                                                                                                                                                          Function 0042513E Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • WriteConsoleW.KERNEL32(FFFFFFFE,00000000,00000001,00000000,00000000,00000000,00000000,00000002,00000000), ref: 00425186
                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00425199
                                                                                                                                                                          • GetConsoleOutputCP.KERNEL32(00000000,00000000,00000001,00000002,00000005,00000000,00000000,00000000,00000000,00000002,00000000), ref: 004251B9
                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(00000000), ref: 004251C0
                                                                                                                                                                          • WriteConsoleA.KERNEL32(FFFFFFFE,?,00000000,?,00000000), ref: 004251DC
                                                                                                                                                                            • Part of subcall function 00426D55: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00425169,00000000,00000000,00000002,00000000), ref: 00426D68
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1850339568-0
                                                                                                                                                                          • Opcode ID: 3fde0de84140aa5b76e31e7b27ee8f43fdf9ca56f866119cd92f9b765763b0e7
                                                                                                                                                                          • Instruction ID: d0f421d0a58dc8f93451a55b2dc7c171cc865a771fc7fc24c42c122e9cb4cc85
                                                                                                                                                                          • Opcode Fuzzy Hash: 3fde0de84140aa5b76e31e7b27ee8f43fdf9ca56f866119cd92f9b765763b0e7
                                                                                                                                                                          • Instruction Fuzzy Hash: 3521A135E00625AFD7109B65EC08EBB3768EB50360F81463FF522C61A0DBB89A41CF99
                                                                                                                                                                          Function 00464950 Relevance: 7.6, APIs: 5, Instructions: 68networkCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                                                                                          • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 00464985
                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
                                                                                                                                                                          • connect.WSOCK32(00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649CD
                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
                                                                                                                                                                          • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 00464A07
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ErrorLast$closesocketconnectinet_addrsocket
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 245547762-0
                                                                                                                                                                          • Opcode ID: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                                                                                          • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
                                                                                                                                                                          • Opcode Fuzzy Hash: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                                                                                          • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
                                                                                                                                                                          Function 0044710F Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                          • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                          • SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                          • BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                          • SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Object$Select$BeginCreateDeletePath
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2338827641-0
                                                                                                                                                                          • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                                                                                          • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
                                                                                                                                                                          • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                                                                                          • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
                                                                                                                                                                          Function 0043770A Relevance: 7.6, APIs: 5, Instructions: 56sleepCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CounterPerformanceQuerySleep
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2875609808-0
                                                                                                                                                                          • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                                                                                          • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
                                                                                                                                                                          • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                                                                                          • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
                                                                                                                                                                          Function 0046FCC6 Relevance: 7.5, APIs: 5, Instructions: 49windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32 ref: 0046FD00
                                                                                                                                                                          • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
                                                                                                                                                                          • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 0046FD58
                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 0046FD5F
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$DestroyIcon
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3419509030-0
                                                                                                                                                                          • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                                                                                          • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
                                                                                                                                                                          • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                                                                                          • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
                                                                                                                                                                          Function 004555B8 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Destroy$DeleteObjectWindow$Icon
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 4023252218-0
                                                                                                                                                                          • Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                                                                                          • Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
                                                                                                                                                                          • Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                                                                                          • Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69
                                                                                                                                                                          Function 0046032B Relevance: 7.5, APIs: 5, Instructions: 43windowtimeCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetDlgItem.USER32(?,000003E9), ref: 00460342
                                                                                                                                                                          • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
                                                                                                                                                                          • MessageBeep.USER32(00000000), ref: 0046036D
                                                                                                                                                                          • KillTimer.USER32(?,0000040A), ref: 00460392
                                                                                                                                                                          • EndDialog.USER32(?,00000001), ref: 004603AB
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3741023627-0
                                                                                                                                                                          • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                                                                                          • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
                                                                                                                                                                          • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                                                                                          • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
                                                                                                                                                                          Function 00455505 Relevance: 7.5, APIs: 5, Instructions: 43windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: DeleteDestroyObject$IconMessageSendWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1489400265-0
                                                                                                                                                                          • Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                                                                                          • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
                                                                                                                                                                          • Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                                                                                          • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
                                                                                                                                                                          Function 0045551F Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1042038666-0
                                                                                                                                                                          • Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                                                                                          • Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
                                                                                                                                                                          • Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                                                                                          • Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79
                                                                                                                                                                          Function 0043315E Relevance: 7.5, APIs: 5, Instructions: 33COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2625713937-0
                                                                                                                                                                          • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                                                                                          • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
                                                                                                                                                                          • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                                                                                          • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
                                                                                                                                                                          Function 0040AB16 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 423COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID: Default$|k
                                                                                                                                                                          • API String ID: 0-2254895183
                                                                                                                                                                          • Opcode ID: 404d7240c4bb856f681ff9cdf52c8ed6758caabbd7f7f5126ad75ded5c77f63b
                                                                                                                                                                          • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
                                                                                                                                                                          • Opcode Fuzzy Hash: 404d7240c4bb856f681ff9cdf52c8ed6758caabbd7f7f5126ad75ded5c77f63b
                                                                                                                                                                          • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
                                                                                                                                                                          Function 00466999 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 312COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetOpenFileNameW.COMDLG32(00000058), ref: 00466CFE
                                                                                                                                                                          • GetSaveFileNameW.COMDLG32(00000058), ref: 00466D9E
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: FileName$OpenSave
                                                                                                                                                                          • String ID: X$HH
                                                                                                                                                                          • API String ID: 3924019920-1944015008
                                                                                                                                                                          • Opcode ID: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
                                                                                                                                                                          • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
                                                                                                                                                                          • Opcode Fuzzy Hash: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
                                                                                                                                                                          • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
                                                                                                                                                                          Function 0046CDA0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 263comCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CoInitialize.OLE32(00000000), ref: 0046CE18
                                                                                                                                                                          • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
                                                                                                                                                                          • CoUninitialize.OLE32 ref: 0046CE50
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CreateInitializeInstanceUninitialize
                                                                                                                                                                          • String ID: .lnk
                                                                                                                                                                          • API String ID: 948891078-24824748
                                                                                                                                                                          • Opcode ID: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                                                                                          • Instruction ID: 09ec1e36491b9dee8eccbfa157b0fc1a83632a56aae6c10d58f94140378ad3aa
                                                                                                                                                                          • Opcode Fuzzy Hash: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                                                                                          • Instruction Fuzzy Hash: D3A1ABB5A042019FC704EF64C980E6BB7E9EF88714F14895EF8849B392D735EC45CBA6
                                                                                                                                                                          Function 0045377F Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 236windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
                                                                                                                                                                          • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
                                                                                                                                                                          • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ItemMenu$Info$Default
                                                                                                                                                                          • String ID: 0
                                                                                                                                                                          • API String ID: 1306138088-4108050209
                                                                                                                                                                          • Opcode ID: c8c2b72c749714a23e45c10816ef9459d7fe91b5f095051f547869ed1843acb9
                                                                                                                                                                          • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
                                                                                                                                                                          • Opcode Fuzzy Hash: c8c2b72c749714a23e45c10816ef9459d7fe91b5f095051f547869ed1843acb9
                                                                                                                                                                          • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
                                                                                                                                                                          Function 0042D2CC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 204COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
                                                                                                                                                                          • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
                                                                                                                                                                          • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Variant$ClearCopyInit
                                                                                                                                                                          • String ID: 4RH
                                                                                                                                                                          • API String ID: 1785138364-749298218
                                                                                                                                                                          • Opcode ID: c26f7a3086022908b18cdef591f48b83bab91b2854b3ff3a8353accd24870fc8
                                                                                                                                                                          • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
                                                                                                                                                                          • Opcode Fuzzy Hash: c26f7a3086022908b18cdef591f48b83bab91b2854b3ff3a8353accd24870fc8
                                                                                                                                                                          • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
                                                                                                                                                                          Function 00457C08 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CloseExecuteHandleShell
                                                                                                                                                                          • String ID: <$@
                                                                                                                                                                          • API String ID: 283469938-1426351568
                                                                                                                                                                          • Opcode ID: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
                                                                                                                                                                          • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
                                                                                                                                                                          • Opcode Fuzzy Hash: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
                                                                                                                                                                          • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
                                                                                                                                                                          Function 00438A5D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                                                                                                                                                                          • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
                                                                                                                                                                            • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
                                                                                                                                                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
                                                                                                                                                                          • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$MemoryProcess$ReadWrite
                                                                                                                                                                          • String ID: @
                                                                                                                                                                          • API String ID: 4055202900-2766056989
                                                                                                                                                                          • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                                                                                          • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
                                                                                                                                                                          • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                                                                                          • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
                                                                                                                                                                          Function 0045F132 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetMenuItemInfoW.USER32 ref: 0045F1B9
                                                                                                                                                                          • DeleteMenu.USER32(?,?,00000000), ref: 0045F218
                                                                                                                                                                          • DeleteMenu.USER32(?,?,00000000), ref: 0045F27A
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Menu$Delete$InfoItem
                                                                                                                                                                          • String ID: 0
                                                                                                                                                                          • API String ID: 135850232-4108050209
                                                                                                                                                                          • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                                                                                          • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
                                                                                                                                                                          • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                                                                                          • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
                                                                                                                                                                          Function 0044A7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116networkCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
                                                                                                                                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
                                                                                                                                                                          • HttpQueryInfoW.WININET ref: 0044A892
                                                                                                                                                                            • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3705125965-3916222277
                                                                                                                                                                          • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                                                                                          • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
                                                                                                                                                                          • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                                                                                          • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
                                                                                                                                                                          Function 004509D1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00450AA2
                                                                                                                                                                          • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00450AB3
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$Long
                                                                                                                                                                          • String ID: SysTreeView32
                                                                                                                                                                          • API String ID: 847901565-1698111956
                                                                                                                                                                          • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                                                                                          • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
                                                                                                                                                                          • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                                                                                          • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
                                                                                                                                                                          Function 00437CA6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadLibraryA.KERNEL32(?), ref: 00437CB2
                                                                                                                                                                          • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Library$AddressFreeLoadProc
                                                                                                                                                                          • String ID: AU3_GetPluginDetails
                                                                                                                                                                          • API String ID: 145871493-4132174516
                                                                                                                                                                          • Opcode ID: 4d29db7c409dc1d8665f13fcd2a771d904d38d92e5d57695c8085be3ce6f429e
                                                                                                                                                                          • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
                                                                                                                                                                          • Opcode Fuzzy Hash: 4d29db7c409dc1d8665f13fcd2a771d904d38d92e5d57695c8085be3ce6f429e
                                                                                                                                                                          • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
                                                                                                                                                                          Function 0044BBC9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100filestringCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\Purchase Order.exe,?,C:\Users\user\Desktop\Purchase Order.exe,004A8E80,C:\Users\user\Desktop\Purchase Order.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                          • lstrcmpiW.KERNEL32(?,?), ref: 0044BC04
                                                                                                                                                                          • MoveFileW.KERNEL32(?,?), ref: 0044BC38
                                                                                                                                                                          • SHFileOperationW.SHELL32 ref: 0044BD16
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: File$FullMoveNameOperationPathlstrcmpi
                                                                                                                                                                          • String ID: \*.*
                                                                                                                                                                          • API String ID: 1148786053-1173974218
                                                                                                                                                                          • Opcode ID: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                                                                                          • Instruction ID: 9e4979448571685848097db6772507fbfe8bfb8d1337cd0032b1ea927bdad9db
                                                                                                                                                                          • Opcode Fuzzy Hash: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                                                                                          • Instruction Fuzzy Hash: 4B3183B14083019AD724EF21C5D5ADFB3E4EFC8304F444D6EB98993251EB39E608D7AA
                                                                                                                                                                          Function 00450C09 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DestroyWindow.USER32(00000000,004A83D8,00000000,?,?), ref: 00450C60
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: DestroyWindow
                                                                                                                                                                          • String ID: msctls_updown32
                                                                                                                                                                          • API String ID: 3375834691-2298589950
                                                                                                                                                                          • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                                                                                          • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
                                                                                                                                                                          • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                                                                                          • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
                                                                                                                                                                          Function 00451191 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
                                                                                                                                                                          • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$MoveWindow
                                                                                                                                                                          • String ID: Listbox
                                                                                                                                                                          • API String ID: 3315199576-2633736733
                                                                                                                                                                          • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                                                                                          • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
                                                                                                                                                                          • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                                                                                          • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
                                                                                                                                                                          Function 004609BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                                                                                            • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                                                                                            • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                                                                                            • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                                                                                          • GetFocus.USER32 ref: 004609EF
                                                                                                                                                                            • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
                                                                                                                                                                            • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
                                                                                                                                                                          • EnumChildWindows.USER32(?,00445A31,?), ref: 00460A60
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows
                                                                                                                                                                          • String ID: %s%d
                                                                                                                                                                          • API String ID: 3342072951-1110647743
                                                                                                                                                                          • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                                                                                          • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
                                                                                                                                                                          • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                                                                                          • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
                                                                                                                                                                          Function 0045D235 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D243
                                                                                                                                                                          • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
                                                                                                                                                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ErrorMode$InformationVolume
                                                                                                                                                                          • String ID: HH
                                                                                                                                                                          • API String ID: 2507767853-2761332787
                                                                                                                                                                          • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                                                                                          • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
                                                                                                                                                                          • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                                                                                          • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
                                                                                                                                                                          Function 0045D42B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
                                                                                                                                                                          • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
                                                                                                                                                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ErrorMode$InformationVolume
                                                                                                                                                                          • String ID: HH
                                                                                                                                                                          • API String ID: 2507767853-2761332787
                                                                                                                                                                          • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                                                                                          • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
                                                                                                                                                                          • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                                                                                          • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
                                                                                                                                                                          Function 00450D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
                                                                                                                                                                          • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                          • String ID: msctls_trackbar32
                                                                                                                                                                          • API String ID: 3850602802-1010561917
                                                                                                                                                                          • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                                                                                          • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
                                                                                                                                                                          • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                                                                                          • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
                                                                                                                                                                          Function 0046BD4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69networkCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                                                                                          • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046BD78
                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000,?,?,00000000,?,?), ref: 0046BD83
                                                                                                                                                                          • inet_ntoa.WSOCK32(00000000,?), ref: 0046BDCD
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
                                                                                                                                                                          • String ID: HH
                                                                                                                                                                          • API String ID: 1515696956-2761332787
                                                                                                                                                                          • Opcode ID: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                                                                                          • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
                                                                                                                                                                          • Opcode Fuzzy Hash: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                                                                                          • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
                                                                                                                                                                          Function 004497A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetMenuItemInfoW.USER32 ref: 004497EA
                                                                                                                                                                          • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
                                                                                                                                                                          • DrawMenuBar.USER32 ref: 00449828
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Menu$InfoItem$Draw
                                                                                                                                                                          • String ID: 0
                                                                                                                                                                          • API String ID: 3227129158-4108050209
                                                                                                                                                                          • Opcode ID: 80c8cc45c3a2388c5d5a2fad2fa293faafe293b1266d5f5cdbd09ec66a21ca10
                                                                                                                                                                          • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
                                                                                                                                                                          • Opcode Fuzzy Hash: 80c8cc45c3a2388c5d5a2fad2fa293faafe293b1266d5f5cdbd09ec66a21ca10
                                                                                                                                                                          • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
                                                                                                                                                                          Function 00416AD5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • TlsFree.KERNEL32(00000017,00416FB1), ref: 00416B00
                                                                                                                                                                          • DeleteCriticalSection.KERNEL32(00000000,00000000,KERNEL32.DLL,?,00416FB1), ref: 004182F3
                                                                                                                                                                          • DeleteCriticalSection.KERNEL32(00000017,KERNEL32.DLL,?,00416FB1), ref: 0041831D
                                                                                                                                                                            • Part of subcall function 004169E9: TlsGetValue.KERNEL32(00411739,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 004169FB
                                                                                                                                                                            • Part of subcall function 004169E9: TlsGetValue.KERNEL32(00000005,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00416A12
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CriticalDeleteSectionValue$Free
                                                                                                                                                                          • String ID: KERNEL32.DLL
                                                                                                                                                                          • API String ID: 3936257031-2576044830
                                                                                                                                                                          • Opcode ID: 4edcc429f782e47b3d6ca153a441a70e2b111d037376c7f0eede9fe860c843eb
                                                                                                                                                                          • Instruction ID: f80bf491939f1815d6b95db29b547c1add7b203e7a040b93f80d5043d0177117
                                                                                                                                                                          • Opcode Fuzzy Hash: 4edcc429f782e47b3d6ca153a441a70e2b111d037376c7f0eede9fe860c843eb
                                                                                                                                                                          • Instruction Fuzzy Hash: 530140329006109FCA345B689D8589A77A8AF61735325477FE8B8E32E0CF3D9C81C65D
                                                                                                                                                                          Function 0040F3B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetOpenFileNameW.COMDLG32 ref: 0042CD51
                                                                                                                                                                            • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\Purchase Order.exe,?,C:\Users\user\Desktop\Purchase Order.exe,004A8E80,C:\Users\user\Desktop\Purchase Order.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                            • Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
                                                                                                                                                                            • Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                                                                                                                                                                            • Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                                                                                                                                                                            • Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: NamePath$Full$DesktopFileFolderFromListMallocOpen
                                                                                                                                                                          • String ID: $OH$@OH$X
                                                                                                                                                                          • API String ID: 819131735-1394974532
                                                                                                                                                                          • Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                                                                                          • Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
                                                                                                                                                                          • Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                                                                                          • Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A
                                                                                                                                                                          Function 004117D8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetModuleHandleW.KERNEL32(mscoree.dll,?,00411810,00411739,?,00418376,000000FF,0000001E,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004), ref: 004117E2
                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004117F2
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AddressHandleModuleProc
                                                                                                                                                                          • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                          • API String ID: 1646373207-1276376045
                                                                                                                                                                          • Opcode ID: a7685ab17104cc0c073debe12178e0060415aba7f1dae0483c91b0ec95b921c4
                                                                                                                                                                          • Instruction ID: 6b29009f96e0e291b67a18ed51c26f61cb0bd4e92b549ae29e71b4d684277c2c
                                                                                                                                                                          • Opcode Fuzzy Hash: a7685ab17104cc0c073debe12178e0060415aba7f1dae0483c91b0ec95b921c4
                                                                                                                                                                          • Instruction Fuzzy Hash: 42D0C9302402096B9F247BB29D09A5F3A5EBE80B613248836BD28D2160DAAAC8408668
                                                                                                                                                                          Function 0043416A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                          • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                                                                                                          • API String ID: 2574300362-1816364905
                                                                                                                                                                          • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                                                                                          • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
                                                                                                                                                                          • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                                                                                          • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
                                                                                                                                                                          Function 004343CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,?,?,00000000,?,?,00000101,?), ref: 004343DE
                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                          • String ID: ICMP.DLL$IcmpSendEcho
                                                                                                                                                                          • API String ID: 2574300362-58917771
                                                                                                                                                                          • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                                                                                          • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
                                                                                                                                                                          • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                                                                                          • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
                                                                                                                                                                          Function 004343FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                          • String ID: ICMP.DLL$IcmpCloseHandle
                                                                                                                                                                          • API String ID: 2574300362-3530519716
                                                                                                                                                                          • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                                                                                          • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
                                                                                                                                                                          • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                                                                                          • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
                                                                                                                                                                          Function 0043442C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                          • String ID: ICMP.DLL$IcmpCreateFile
                                                                                                                                                                          • API String ID: 2574300362-275556492
                                                                                                                                                                          • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                                                                                          • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
                                                                                                                                                                          • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                                                                                          • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
                                                                                                                                                                          Function 0040EE70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • LoadLibraryA.KERNEL32(kernel32.dll,0040E551,?), ref: 0040EE7B
                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040EE8D
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                          • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                          • API String ID: 2574300362-3024904723
                                                                                                                                                                          • Opcode ID: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                                                                                                          • Instruction ID: 75875fa2f3f8b89ed4c8cde0d061cde3839b728dd3838c322d7dfd2ddbff31fa
                                                                                                                                                                          • Opcode Fuzzy Hash: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                                                                                                          • Instruction Fuzzy Hash: 51D0C9B0940707DAC7301F72C91871B7AE4AB40342F204C3EB995A1290DBBCC0408B28
                                                                                                                                                                          Function 00422570 Relevance: 6.4, APIs: 5, Instructions: 181COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                                                                                          • GetLastError.KERNEL32(?,00411376,00000000,00000010,?,?,?,00411402,00411766,0048C6A8,0000000C,0041142E,00411766,?,00411766), ref: 004226EB
                                                                                                                                                                          • GetLastError.KERNEL32(?,00411376,00000000,00000010,?,?,?,00411402,00411766,0048C6A8,0000000C,0041142E,00411766,?,00411766), ref: 00422778
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ErrorLast$AllocateHeap
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 4219743298-0
                                                                                                                                                                          • Opcode ID: 2fd8fadab811a430797da95cb73ff5430e569562758129bd436d71f1837a3659
                                                                                                                                                                          • Instruction ID: 318ae3f89a2250df876bedb69491e74a10a758e61cab592b37fb59630da9e0ad
                                                                                                                                                                          • Opcode Fuzzy Hash: 2fd8fadab811a430797da95cb73ff5430e569562758129bd436d71f1837a3659
                                                                                                                                                                          • Instruction Fuzzy Hash: 38510A71E04231BACF216B75BE44AAF7A64EF40364B60452BF85467391DBBC8C818B9D
                                                                                                                                                                          Function 0040ACA0 Relevance: 6.4, APIs: 4, Instructions: 368COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ClearVariant
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1473721057-0
                                                                                                                                                                          • Opcode ID: 864e75c6b64c8395072179653f2e6e54ed688e1196af63861ce1262d91a289fa
                                                                                                                                                                          • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
                                                                                                                                                                          • Opcode Fuzzy Hash: 864e75c6b64c8395072179653f2e6e54ed688e1196af63861ce1262d91a289fa
                                                                                                                                                                          • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
                                                                                                                                                                          Function 0047375F Relevance: 6.2, APIs: 4, Instructions: 150processCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
                                                                                                                                                                          • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
                                                                                                                                                                          • Process32NextW.KERNEL32(00000000,?), ref: 00473844
                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 420147892-0
                                                                                                                                                                          • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                                                                                          • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
                                                                                                                                                                          • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                                                                                          • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
                                                                                                                                                                          Function 004781AE Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                          • VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                          • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                          • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CopyVariant$ErrorLast
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2286883814-0
                                                                                                                                                                          • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                                                                                          • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
                                                                                                                                                                          • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                                                                                          • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
                                                                                                                                                                          Function 0047404B Relevance: 6.1, APIs: 4, Instructions: 133networkCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
                                                                                                                                                                          • #21.WSOCK32 ref: 004740E0
                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 004740EB
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ErrorLast$socket
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1881357543-0
                                                                                                                                                                          • Opcode ID: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                                                                                          • Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
                                                                                                                                                                          • Opcode Fuzzy Hash: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                                                                                          • Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C
                                                                                                                                                                          Function 00441CB4 Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                                                                                          • PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                                                                                          • MessageBeep.USER32(00000000), ref: 00441DF2
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Rect$BeepClientMessageScreenWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1352109105-0
                                                                                                                                                                          • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                                                                                          • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
                                                                                                                                                                          • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                                                                                          • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
                                                                                                                                                                          Function 0045D070 Relevance: 6.1, APIs: 4, Instructions: 100fileCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
                                                                                                                                                                          • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
                                                                                                                                                                          • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
                                                                                                                                                                          • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3321077145-0
                                                                                                                                                                          • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                                                                                          • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
                                                                                                                                                                          • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                                                                                          • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
                                                                                                                                                                          Function 0045058D Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetParent.USER32(?), ref: 004505BF
                                                                                                                                                                          • DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
                                                                                                                                                                          • DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
                                                                                                                                                                          • DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Proc$Parent
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2351499541-0
                                                                                                                                                                          • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                                                                                          • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
                                                                                                                                                                          • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                                                                                          • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
                                                                                                                                                                          Function 004727F8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 00472806
                                                                                                                                                                            • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
                                                                                                                                                                            • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
                                                                                                                                                                            • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
                                                                                                                                                                          • GetCaretPos.USER32(?), ref: 0047281A
                                                                                                                                                                          • ClientToScreen.USER32(00000000,?), ref: 00472856
                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 0047285C
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2759813231-0
                                                                                                                                                                          • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                                                                                          • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
                                                                                                                                                                          • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                                                                                          • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
                                                                                                                                                                          Function 00445719 Relevance: 6.1, APIs: 4, Instructions: 76windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • IsWindowVisible.USER32(?), ref: 00445721
                                                                                                                                                                          • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
                                                                                                                                                                          • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
                                                                                                                                                                          • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$BuffCharUpperVisibleWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2796087071-0
                                                                                                                                                                          • Opcode ID: 07a683c3f77dae50ee773e7e3fa5154241049f7b31449e9a489b3be5124be6a3
                                                                                                                                                                          • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
                                                                                                                                                                          • Opcode Fuzzy Hash: 07a683c3f77dae50ee773e7e3fa5154241049f7b31449e9a489b3be5124be6a3
                                                                                                                                                                          • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
                                                                                                                                                                          Function 0047721A Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 0047728E
                                                                                                                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
                                                                                                                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
                                                                                                                                                                          • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$Long$AttributesLayered
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2169480361-0
                                                                                                                                                                          • Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                                                                                          • Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
                                                                                                                                                                          • Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                                                                                          • Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8
                                                                                                                                                                          Function 00448C8B Relevance: 6.1, APIs: 4, Instructions: 73windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32 ref: 00448CB8
                                                                                                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 00448CE0
                                                                                                                                                                          • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
                                                                                                                                                                          • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend$LongWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 312131281-0
                                                                                                                                                                          • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                                                                                          • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
                                                                                                                                                                          • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                                                                                          • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
                                                                                                                                                                          Function 004588B0 Relevance: 6.1, APIs: 4, Instructions: 67networkCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • select.WSOCK32 ref: 0045890A
                                                                                                                                                                          • __WSAFDIsSet.WSOCK32(00000000,00000000), ref: 00458919
                                                                                                                                                                          • accept.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 00458927
                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 00458952
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ErrorLastacceptselect
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 385091864-0
                                                                                                                                                                          • Opcode ID: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                                                                                          • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
                                                                                                                                                                          • Opcode Fuzzy Hash: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                                                                                          • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
                                                                                                                                                                          Function 00438D4E Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
                                                                                                                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
                                                                                                                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
                                                                                                                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3850602802-0
                                                                                                                                                                          • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                                                                                          • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
                                                                                                                                                                          • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                                                                                          • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
                                                                                                                                                                          Function 0043362D Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
                                                                                                                                                                          • GetStockObject.GDI32(00000011), ref: 00433695
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
                                                                                                                                                                          • ShowWindow.USER32(00000000,00000000), ref: 004336BA
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Window$CreateMessageObjectSendShowStock
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 1358664141-0
                                                                                                                                                                          • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                                                                                          • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
                                                                                                                                                                          • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                                                                                          • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
                                                                                                                                                                          Function 0044419B Relevance: 6.1, APIs: 4, Instructions: 53synchronizationthreadwindowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004441B8
                                                                                                                                                                          • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
                                                                                                                                                                          • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00444213
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2880819207-0
                                                                                                                                                                          • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                                                                                          • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
                                                                                                                                                                          • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                                                                                          • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
                                                                                                                                                                          Function 0043401C Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00434037
                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 0043405B
                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00434085
                                                                                                                                                                          • InvalidateRect.USER32(?,?,?), ref: 004340A4
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ClientRectScreen$InvalidateWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 357397906-0
                                                                                                                                                                          • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                                                                                          • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
                                                                                                                                                                          • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                                                                                          • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
                                                                                                                                                                          Function 004555D6 Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: DeleteDestroyObject$IconWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3349847261-0
                                                                                                                                                                          • Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                                                                                          • Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
                                                                                                                                                                          • Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                                                                                          • Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D
                                                                                                                                                                          Function 0044B600 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • EnterCriticalSection.KERNEL32(?), ref: 0044B60B
                                                                                                                                                                          • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
                                                                                                                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0044B630
                                                                                                                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0044B641
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2223660684-0
                                                                                                                                                                          • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                                                                                          • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
                                                                                                                                                                          • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                                                                                          • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
                                                                                                                                                                          Function 00447268 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                            • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                            • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                            • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                          • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
                                                                                                                                                                          • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
                                                                                                                                                                          • EndPath.GDI32(?), ref: 004472B0
                                                                                                                                                                          • StrokePath.GDI32(?), ref: 004472BE
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2783949968-0
                                                                                                                                                                          • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                                                                                          • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
                                                                                                                                                                          • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                                                                                          • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
                                                                                                                                                                          Function 00471144 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 00471144
                                                                                                                                                                          • GetDC.USER32(00000000), ref: 0047114D
                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
                                                                                                                                                                          • ReleaseDC.USER32(00000000,?), ref: 0047117B
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2889604237-0
                                                                                                                                                                          • Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                                                                                          • Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
                                                                                                                                                                          • Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                                                                                          • Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99
                                                                                                                                                                          Function 00471102 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 00471102
                                                                                                                                                                          • GetDC.USER32(00000000), ref: 0047110B
                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
                                                                                                                                                                          • ReleaseDC.USER32(00000000,?), ref: 00471139
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2889604237-0
                                                                                                                                                                          • Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                                                                                          • Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
                                                                                                                                                                          • Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                                                                                          • Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99
                                                                                                                                                                          Function 004389A1 Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                                                                                          • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                                                                                          • AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 2710830443-0
                                                                                                                                                                          • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                                                                                          • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
                                                                                                                                                                          • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                                                                                          • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
                                                                                                                                                                          Function 004390C2 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
                                                                                                                                                                          • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0
                                                                                                                                                                            • Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
                                                                                                                                                                            • Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 146765662-0
                                                                                                                                                                          • Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                                                                                          • Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
                                                                                                                                                                          • Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                                                                                          • Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65
                                                                                                                                                                          Function 00478373 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277comCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
                                                                                                                                                                            • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
                                                                                                                                                                            • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: CopyVariant$ContainedObject$ErrorLast
                                                                                                                                                                          • String ID: AutoIt3GUI$Container
                                                                                                                                                                          • API String ID: 4053020530-3941886329
                                                                                                                                                                          • Opcode ID: a9ff7069b9b8d6ccd49eba872ad7efd2467de888f1098c4430e935d21ee713db
                                                                                                                                                                          • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
                                                                                                                                                                          • Opcode Fuzzy Hash: a9ff7069b9b8d6ccd49eba872ad7efd2467de888f1098c4430e935d21ee713db
                                                                                                                                                                          • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
                                                                                                                                                                          Function 0045427D Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 259libraryloaderCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00000000), ref: 0045435B
                                                                                                                                                                          • GetProcAddress.KERNEL32(?,AU3_FreeVar), ref: 00454371
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AddressProc
                                                                                                                                                                          • String ID: AU3_FreeVar
                                                                                                                                                                          • API String ID: 190572456-771828931
                                                                                                                                                                          • Opcode ID: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
                                                                                                                                                                          • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
                                                                                                                                                                          • Opcode Fuzzy Hash: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
                                                                                                                                                                          • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
                                                                                                                                                                          Function 004667A7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 170shareCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Connection
                                                                                                                                                                          • String ID: LPT$HH
                                                                                                                                                                          • API String ID: 1722446006-2728063697
                                                                                                                                                                          • Opcode ID: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
                                                                                                                                                                          • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
                                                                                                                                                                          • Opcode Fuzzy Hash: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
                                                                                                                                                                          • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
                                                                                                                                                                          Function 00466587 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID:
                                                                                                                                                                          • String ID: HH$HH
                                                                                                                                                                          • API String ID: 0-1787419579
                                                                                                                                                                          • Opcode ID: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
                                                                                                                                                                          • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
                                                                                                                                                                          • Opcode Fuzzy Hash: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
                                                                                                                                                                          • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
                                                                                                                                                                          Function 00448358 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
                                                                                                                                                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                          • String ID: '
                                                                                                                                                                          • API String ID: 3850602802-1997036262
                                                                                                                                                                          • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                                                                                          • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
                                                                                                                                                                          • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                                                                                          • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
                                                                                                                                                                          Function 00401BE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                                                                                          • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: IconLoadNotifyShell_String
                                                                                                                                                                          • String ID: Line:
                                                                                                                                                                          • API String ID: 3363329723-1585850449
                                                                                                                                                                          • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                                                                                          • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
                                                                                                                                                                          • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                                                                                          • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B
                                                                                                                                                                          Function 0045126C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
                                                                                                                                                                          • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                          • String ID: Combobox
                                                                                                                                                                          • API String ID: 3850602802-2096851135
                                                                                                                                                                          • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                                                                                          • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
                                                                                                                                                                          • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                                                                                          • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
                                                                                                                                                                          Function 004515AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
                                                                                                                                                                          • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: LengthMessageSendTextWindow
                                                                                                                                                                          • String ID: edit
                                                                                                                                                                          • API String ID: 2978978980-2167791130
                                                                                                                                                                          • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                                                                                          • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
                                                                                                                                                                          • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                                                                                          • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
                                                                                                                                                                          Function 00474827 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • Sleep.KERNEL32(00000000), ref: 00474833
                                                                                                                                                                          • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: GlobalMemorySleepStatus
                                                                                                                                                                          • String ID: @
                                                                                                                                                                          • API String ID: 2783356886-2766056989
                                                                                                                                                                          • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                                                                                          • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
                                                                                                                                                                          • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                                                                                          • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
                                                                                                                                                                          Function 004222B1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Purchase Order.exe,00000104), ref: 004222D1
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: FileModuleName
                                                                                                                                                                          • String ID: C:\Users\user\Desktop\Purchase Order.exe$lI
                                                                                                                                                                          • API String ID: 514040917-4238000255
                                                                                                                                                                          • Opcode ID: 6471261ceed6c4e84fcd86acbbd5ec6f229b0cd72896a57254f0e496610a85db
                                                                                                                                                                          • Instruction ID: 949a5422ac16129abcdf6a7e13ae2ad22a8803a3c22bcf3cdebf143c23a23c82
                                                                                                                                                                          • Opcode Fuzzy Hash: 6471261ceed6c4e84fcd86acbbd5ec6f229b0cd72896a57254f0e496610a85db
                                                                                                                                                                          • Instruction Fuzzy Hash: CD11B172700229BB8B14CBA4FE808EE77A8EB49360765053FF511D3290EA78DE018768
                                                                                                                                                                          Function 004647A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: htonsinet_addr
                                                                                                                                                                          • String ID: 255.255.255.255
                                                                                                                                                                          • API String ID: 3832099526-2422070025
                                                                                                                                                                          • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                                                                                          • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
                                                                                                                                                                          • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                                                                                          • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
                                                                                                                                                                          Function 004694DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                          • API String ID: 3850602802-1403004172
                                                                                                                                                                          • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                                                                                          • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
                                                                                                                                                                          • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                                                                                          • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
                                                                                                                                                                          Function 00442AFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: InternetOpen
                                                                                                                                                                          • String ID: <local>
                                                                                                                                                                          • API String ID: 2038078732-4266983199
                                                                                                                                                                          • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                                                                                          • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
                                                                                                                                                                          • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                                                                                          • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
                                                                                                                                                                          Function 004695F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                          • API String ID: 3850602802-1403004172
                                                                                                                                                                          • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                                                                                          • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
                                                                                                                                                                          • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                                                                                          • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
                                                                                                                                                                          Function 0046956F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                          • API String ID: 3850602802-1403004172
                                                                                                                                                                          • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                                                                                          • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
                                                                                                                                                                          • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                                                                                          • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
                                                                                                                                                                          Function 004560AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
                                                                                                                                                                          • wsprintfW.USER32 ref: 004560E9
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: MessageSendwsprintf
                                                                                                                                                                          • String ID: %d/%02d/%02d
                                                                                                                                                                          • API String ID: 3751067900-328681919
                                                                                                                                                                          • Opcode ID: dc5fd9a877cd0fc352ed6de9b5f97ee6fb2dcbb154e3a48ad4a1e49fbb654ae8
                                                                                                                                                                          • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
                                                                                                                                                                          • Opcode Fuzzy Hash: dc5fd9a877cd0fc352ed6de9b5f97ee6fb2dcbb154e3a48ad4a1e49fbb654ae8
                                                                                                                                                                          • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
                                                                                                                                                                          Function 00442262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
                                                                                                                                                                          • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
                                                                                                                                                                            • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: FindMessagePostSleepWindow
                                                                                                                                                                          • String ID: Shell_TrayWnd
                                                                                                                                                                          • API String ID: 529655941-2988720461
                                                                                                                                                                          • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                                                                                          • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
                                                                                                                                                                          • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                                                                                          • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
                                                                                                                                                                          Function 0044222A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
                                                                                                                                                                          • PostMessageW.USER32(00000000), ref: 00442247
                                                                                                                                                                            • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: FindMessagePostSleepWindow
                                                                                                                                                                          • String ID: Shell_TrayWnd
                                                                                                                                                                          • API String ID: 529655941-2988720461
                                                                                                                                                                          • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                                                                                          • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
                                                                                                                                                                          • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                                                                                          • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
                                                                                                                                                                          Function 00439514 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
                                                                                                                                                                          Strings
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: Message
                                                                                                                                                                          • String ID: AutoIt$Error allocating memory.
                                                                                                                                                                          • API String ID: 2030045667-4017498283
                                                                                                                                                                          • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                                                                                          • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
                                                                                                                                                                          • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                                                                                          • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E
                                                                                                                                                                          Function 0041A2B3 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON
                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                          APIs
                                                                                                                                                                          • HeapReAlloc.KERNEL32(00000000,-00000010,00000000,00000000,0041A813,00000000,?,00000000,00413979,?,?,00411739,?,00401C0B), ref: 0041A2DA
                                                                                                                                                                          • HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,0041A813,00000000,?,00000000,00413979,?,?,00411739,?,00401C0B), ref: 0041A310
                                                                                                                                                                          • VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,00411739,?,00401C0B), ref: 0041A32A
                                                                                                                                                                          • HeapFree.KERNEL32(00000000,?,?,00411739,?,00401C0B), ref: 0041A341
                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                          • Source File: 00000000.00000002.2479972173.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                          • Associated: 00000000.00000002.2479934559.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480091640.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480129555.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          • Associated: 00000000.00000002.2480200384.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd
                                                                                                                                                                          Similarity
                                                                                                                                                                          • API ID: AllocHeap$FreeVirtual
                                                                                                                                                                          • String ID:
                                                                                                                                                                          • API String ID: 3499195154-0
                                                                                                                                                                          • Opcode ID: bc501b1f3452fb4555c1e7e86ad22a71cea65b8e1d754c6294030291da32ca1b
                                                                                                                                                                          • Instruction ID: c0789fce48f3efc00023f82bc826da5228bc21048a08359dcc1a9c3791e9814b
                                                                                                                                                                          • Opcode Fuzzy Hash: bc501b1f3452fb4555c1e7e86ad22a71cea65b8e1d754c6294030291da32ca1b
                                                                                                                                                                          • Instruction Fuzzy Hash: AD119131604200AFC7214F28ED059567BB5F7597207214A7AF9A6D72F1D3759C828B58