Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PGHPC-10-0033-FZB-001.exe

Overview

General Information

Sample name:PGHPC-10-0033-FZB-001.exe
Analysis ID:1538507
MD5:6d23798eb1eceea0adbe86cef808093b
SHA1:e738ac1d5d53966aa14fd4bd5cb2931d7b1c81c3
SHA256:fd6e6fe49c241c128dec23aa859485c80db889758300a8c4f86f2c404dadf264
Tags:exeuser-lowmal3
Infos:

Detection

Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Machine Learning detection for sample
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found evasive API chain (date check)
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

  • System is w10x64
  • PGHPC-10-0033-FZB-001.exe (PID: 3396 cmdline: "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe" MD5: 6D23798EB1ECEEA0ADBE86CEF808093B)
    • svchost.exe (PID: 6044 cmdline: "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
  • cleanup
No configs have been found
No yara matches
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe", CommandLine: "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe", ParentImage: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe, ParentProcessId: 3396, ParentProcessName: PGHPC-10-0033-FZB-001.exe, ProcessCommandLine: "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe", ProcessId: 6044, ProcessName: svchost.exe
Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe", CommandLine: "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe", ParentImage: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe, ParentProcessId: 3396, ParentProcessName: PGHPC-10-0033-FZB-001.exe, ProcessCommandLine: "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe", ProcessId: 6044, ProcessName: svchost.exe
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: PGHPC-10-0033-FZB-001.exeAvira: detected
Source: PGHPC-10-0033-FZB-001.exeReversingLabs: Detection: 47%
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Source: PGHPC-10-0033-FZB-001.exeJoe Sandbox ML: detected
Source: PGHPC-10-0033-FZB-001.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Binary string: wntdll.pdbUGP source: PGHPC-10-0033-FZB-001.exe, 00000000.00000003.1255334103.0000000004730000.00000004.00001000.00020000.00000000.sdmp, PGHPC-10-0033-FZB-001.exe, 00000000.00000003.1250006053.0000000004590000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1494858457.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1455668675.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1457634850.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1494858457.0000000002F00000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: PGHPC-10-0033-FZB-001.exe, 00000000.00000003.1255334103.0000000004730000.00000004.00001000.00020000.00000000.sdmp, PGHPC-10-0033-FZB-001.exe, 00000000.00000003.1250006053.0000000004590000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1494858457.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1455668675.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1457634850.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1494858457.0000000002F00000.00000040.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,0_2_00456354
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C08E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024CC5A3 NtClose,2_2_024CC5A3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72B60 NtClose,LdrInitializeThunk,2_2_02F72B60
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_02F72DF0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F735C0 NtCreateMutant,LdrInitializeThunk,2_2_02F735C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F74340 NtSetContextThread,2_2_02F74340
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F74650 NtSuspendThread,2_2_02F74650
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72AF0 NtWriteFile,2_2_02F72AF0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72AD0 NtReadFile,2_2_02F72AD0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72AB0 NtWaitForSingleObject,2_2_02F72AB0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72BF0 NtAllocateVirtualMemory,2_2_02F72BF0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72BE0 NtQueryValueKey,2_2_02F72BE0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72BA0 NtEnumerateValueKey,2_2_02F72BA0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72B80 NtQueryInformationFile,2_2_02F72B80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72EE0 NtQueueApcThread,2_2_02F72EE0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72EA0 NtAdjustPrivilegesToken,2_2_02F72EA0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72E80 NtReadVirtualMemory,2_2_02F72E80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72E30 NtWriteVirtualMemory,2_2_02F72E30
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72FE0 NtCreateFile,2_2_02F72FE0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72FB0 NtResumeThread,2_2_02F72FB0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72FA0 NtQuerySection,2_2_02F72FA0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72F90 NtProtectVirtualMemory,2_2_02F72F90
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72F60 NtCreateProcessEx,2_2_02F72F60
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72F30 NtCreateSection,2_2_02F72F30
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72CF0 NtOpenProcess,2_2_02F72CF0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72CC0 NtQueryVirtualMemory,2_2_02F72CC0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72CA0 NtQueryInformationToken,2_2_02F72CA0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72C70 NtFreeVirtualMemory,2_2_02F72C70
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72C60 NtCreateKey,2_2_02F72C60
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72C00 NtQueryInformationProcess,2_2_02F72C00
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72DD0 NtDelayExecution,2_2_02F72DD0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72DB0 NtEnumerateKey,2_2_02F72DB0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72D30 NtUnmapViewOfSection,2_2_02F72D30
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72D10 NtMapViewOfSection,2_2_02F72D10
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72D00 NtSetInformationFile,2_2_02F72D00
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F73090 NtSetValueKey,2_2_02F73090
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F73010 NtOpenDirectoryObject,2_2_02F73010
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F739B0 NtGetContextThread,2_2_02F739B0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F73D70 NtOpenThread,2_2_02F73D70
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F73D10 NtOpenProcessToken,2_2_02F73D10
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_004461ED
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004120380_2_00412038
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004271610_2_00427161
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0047E1FA0_2_0047E1FA
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004212BE0_2_004212BE
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004433900_2_00443390
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004433910_2_00443391
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0041A46B0_2_0041A46B
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0041240C0_2_0041240C
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004465660_2_00446566
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004045E00_2_004045E0
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0041D7500_2_0041D750
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004037E00_2_004037E0
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004278590_2_00427859
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004128180_2_00412818
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0040F8900_2_0040F890
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0042397B0_2_0042397B
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00409A400_2_00409A40
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00411B630_2_00411B63
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0047CBF00_2_0047CBF0
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0044EBBC0_2_0044EBBC
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00412C380_2_00412C38
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0044ED9A0_2_0044ED9A
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00423EBF0_2_00423EBF
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00424F700_2_00424F70
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0041AF0D0_2_0041AF0D
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_03EF02300_2_03EF0230
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024B02432_2_024B0243
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024AE2C32_2_024AE2C3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024AE2BC2_2_024AE2BC
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A2B902_2_024A2B90
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024CEBB32_2_024CEBB3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A30502_2_024A3050
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A10002_2_024A1000
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024B001A2_2_024B001A
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024B00232_2_024B0023
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A11E02_2_024A11E0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A21892_2_024A2189
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024B698F2_2_024B698F
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A219E2_2_024A219E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024B69932_2_024B6993
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A21A02_2_024A21A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A26B02_2_024A26B0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC02C02_2_02FC02C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE02742_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030003E62_2_030003E6
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E3F02_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFA3522_2_02FFA352
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030001AA2_2_030001AA
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD20002_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF81CC2_2_02FF81CC
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF41A22_2_02FF41A2
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC81582_2_02FC8158
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDA1182_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F301002_2_02F30100
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5C6E02_2_02F5C6E0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3C7C02_2_02F3C7C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F407702_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F647502_2_02F64750
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEE4F62_2_02FEE4F6
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030005912_2_03000591
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF24462_2_02FF2446
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE44202_2_02FE4420
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F405352_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA802_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF6BD72_2_02FF6BD7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFAB402_2_02FFAB40
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E8F02_2_02F6E8F0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F268B82_2_02F268B8
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300A9A62_2_0300A9A6
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4A8402_2_02F4A840
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F428402_2_02F42840
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A02_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F569622_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFEEDB2_2_02FFEEDB
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52E902_2_02F52E90
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFCE932_2_02FFCE93
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40E592_2_02F40E59
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFEE262_2_02FFEE26
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4CFE02_2_02F4CFE0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F32FC82_2_02F32FC8
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBEFA02_2_02FBEFA0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB4F402_2_02FB4F40
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F60F302_2_02F60F30
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE2F302_2_02FE2F30
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F82F282_2_02F82F28
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30CF22_2_02F30CF2
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0CB52_2_02FE0CB5
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40C002_2_02F40C00
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3ADE02_2_02F3ADE0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F58DBF2_2_02F58DBF
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDCD1F2_2_02FDCD1F
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4AD002_2_02F4AD00
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE12ED2_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5B2C02_2_02F5B2C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F452A02_2_02F452A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F8739A2_2_02F8739A
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2D34C2_2_02F2D34C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF132D2_2_02FF132D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF70E92_2_02FF70E9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFF0E02_2_02FFF0E0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEF0CC2_2_02FEF0CC
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F470C02_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300B16B2_2_0300B16B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4B1B02_2_02F4B1B0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2F1722_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F7516C2_2_02F7516C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF16CC2_2_02FF16CC
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F856302_2_02F85630
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFF7B02_2_02FFF7B0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F314602_2_02F31460
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFF43F2_2_02FFF43F
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030095C32_2_030095C3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDD5B02_2_02FDD5B0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF75712_2_02FF7571
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEDAC62_2_02FEDAC6
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDDAAC2_2_02FDDAAC
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F85AA02_2_02F85AA0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE1AA32_2_02FE1AA3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB3A6C2_2_02FB3A6C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFFA492_2_02FFFA49
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF7A462_2_02FF7A46
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB5BF02_2_02FB5BF0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F7DBF92_2_02F7DBF9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5FB802_2_02F5FB80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFFB762_2_02FFFB76
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F438E02_2_02F438E0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAD8002_2_02FAD800
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F499502_2_02F49950
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5B9502_2_02F5B950
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD59102_2_02FD5910
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F49EB02_2_02F49EB0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F03FD22_2_02F03FD2
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F03FD52_2_02F03FD5
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFFFB12_2_02FFFFB1
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F41F922_2_02F41F92
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFFF092_2_02FFFF09
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFFCF22_2_02FFFCF2
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB9C322_2_02FB9C32
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5FDC02_2_02F5FDC0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF7D732_2_02FF7D73
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF1D5A2_2_02FF1D5A
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F43D402_2_02F43D40
Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 02F87E54 appears 111 times
Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 02FAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 02FBF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 02F75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 02F2B970 appears 277 times
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: String function: 00445975 appears 65 times
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: String function: 0041171A appears 37 times
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: String function: 0041718C appears 45 times
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: String function: 0040E6D0 appears 35 times
Source: PGHPC-10-0033-FZB-001.exe, 00000000.00000003.1249719063.000000000485D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PGHPC-10-0033-FZB-001.exe
Source: PGHPC-10-0033-FZB-001.exe, 00000000.00000003.1249589342.00000000046B3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PGHPC-10-0033-FZB-001.exe
Source: PGHPC-10-0033-FZB-001.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engineClassification label: mal80.evad.winEXE@3/1@0/0
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,0_2_0043701F
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeFile created: C:\Users\user~1\AppData\Local\Temp\epistemologyJump to behavior
Source: PGHPC-10-0033-FZB-001.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: PGHPC-10-0033-FZB-001.exeReversingLabs: Detection: 47%
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeFile read: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe"
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe"
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe"Jump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
Source: PGHPC-10-0033-FZB-001.exeStatic file information: File size 1338893 > 1048576
Source: Binary string: wntdll.pdbUGP source: PGHPC-10-0033-FZB-001.exe, 00000000.00000003.1255334103.0000000004730000.00000004.00001000.00020000.00000000.sdmp, PGHPC-10-0033-FZB-001.exe, 00000000.00000003.1250006053.0000000004590000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1494858457.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1455668675.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1457634850.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1494858457.0000000002F00000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: PGHPC-10-0033-FZB-001.exe, 00000000.00000003.1255334103.0000000004730000.00000004.00001000.00020000.00000000.sdmp, PGHPC-10-0033-FZB-001.exe, 00000000.00000003.1250006053.0000000004590000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1494858457.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1455668675.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1457634850.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1494858457.0000000002F00000.00000040.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
Source: PGHPC-10-0033-FZB-001.exeStatic PE information: real checksum: 0xa2135 should be: 0x14cbe9
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A32E0 push eax; ret 2_2_024A32E2
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024B9AAE push edx; ret 2_2_024B9AAF
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024BF2AD push cs; retf 2_2_024BF2BA
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A5054 push esi; ret 2_2_024A5075
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024C380B push 0000005Ah; iretd 2_2_024C3829
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024BE9D2 push ss; ret 2_2_024BE9B5
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024BE9EC push es; ret 2_2_024BE9F9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024BE99B push ss; ret 2_2_024BE9B5
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A4E49 push ecx; iretd 2_2_024A4E54
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A2E5B push ds; retf 2_2_024A2E5E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024AD688 pushad ; iretd 2_2_024AD689
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A4F5C push ecx; iretd 2_2_024A4F6D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024A17D9 push esp; iretd 2_2_024A17DC
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024BA7BD push esi; retf 2_2_024BA7BE
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024BF59D pushfd ; iretd 2_2_024BF5B5
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F0225F pushad ; ret 2_2_02F027F9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F027FA pushad ; ret 2_2_02F027F9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F0283D push eax; iretd 2_2_02F02858
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F309AD push ecx; mov dword ptr [esp], ecx2_2_02F309B6
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F01368 push eax; iretd 2_2_02F01369
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004440780_2_00444078
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeAPI/Special instruction interceptor: Address: 3EEFE54
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F7096E rdtsc 2_2_02F7096E
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-86269
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_0-84978
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeAPI coverage: 3.0 %
Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.6 %
Source: C:\Windows\SysWOW64\svchost.exe TID: 2756Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeAPI call chain: ExitProcess graph end nodegraph_0-84828
Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F7096E rdtsc 2_2_02F7096E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_024B78E3 LdrLoadDll,2_2_024B78E3
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_03EF0120 mov eax, dword ptr fs:[00000030h]0_2_03EF0120
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_03EF00C0 mov eax, dword ptr fs:[00000030h]0_2_03EF00C0
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_03EEEA90 mov eax, dword ptr fs:[00000030h]0_2_03EEEA90
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F402E1 mov eax, dword ptr fs:[00000030h]2_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F402E1 mov eax, dword ptr fs:[00000030h]2_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F402E1 mov eax, dword ptr fs:[00000030h]2_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03008324 mov eax, dword ptr fs:[00000030h]2_2_03008324
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03008324 mov ecx, dword ptr fs:[00000030h]2_2_03008324
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03008324 mov eax, dword ptr fs:[00000030h]2_2_03008324
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03008324 mov eax, dword ptr fs:[00000030h]2_2_03008324
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300634F mov eax, dword ptr fs:[00000030h]2_2_0300634F
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F402A0 mov eax, dword ptr fs:[00000030h]2_2_02F402A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F402A0 mov eax, dword ptr fs:[00000030h]2_2_02F402A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC62A0 mov ecx, dword ptr fs:[00000030h]2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E284 mov eax, dword ptr fs:[00000030h]2_2_02F6E284
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E284 mov eax, dword ptr fs:[00000030h]2_2_02F6E284
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB0283 mov eax, dword ptr fs:[00000030h]2_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB0283 mov eax, dword ptr fs:[00000030h]2_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB0283 mov eax, dword ptr fs:[00000030h]2_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34260 mov eax, dword ptr fs:[00000030h]2_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34260 mov eax, dword ptr fs:[00000030h]2_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34260 mov eax, dword ptr fs:[00000030h]2_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2826B mov eax, dword ptr fs:[00000030h]2_2_02F2826B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2A250 mov eax, dword ptr fs:[00000030h]2_2_02F2A250
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36259 mov eax, dword ptr fs:[00000030h]2_2_02F36259
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEA250 mov eax, dword ptr fs:[00000030h]2_2_02FEA250
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEA250 mov eax, dword ptr fs:[00000030h]2_2_02FEA250
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB8243 mov eax, dword ptr fs:[00000030h]2_2_02FB8243
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB8243 mov ecx, dword ptr fs:[00000030h]2_2_02FB8243
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2823B mov eax, dword ptr fs:[00000030h]2_2_02F2823B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]2_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]2_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]2_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F663FF mov eax, dword ptr fs:[00000030h]2_2_02F663FF
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE3DB mov eax, dword ptr fs:[00000030h]2_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE3DB mov eax, dword ptr fs:[00000030h]2_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE3DB mov ecx, dword ptr fs:[00000030h]2_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE3DB mov eax, dword ptr fs:[00000030h]2_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD43D4 mov eax, dword ptr fs:[00000030h]2_2_02FD43D4
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD43D4 mov eax, dword ptr fs:[00000030h]2_2_02FD43D4
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEC3CD mov eax, dword ptr fs:[00000030h]2_2_02FEC3CD
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]2_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]2_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]2_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]2_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB63C0 mov eax, dword ptr fs:[00000030h]2_2_02FB63C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300625D mov eax, dword ptr fs:[00000030h]2_2_0300625D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F28397 mov eax, dword ptr fs:[00000030h]2_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F28397 mov eax, dword ptr fs:[00000030h]2_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F28397 mov eax, dword ptr fs:[00000030h]2_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2E388 mov eax, dword ptr fs:[00000030h]2_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2E388 mov eax, dword ptr fs:[00000030h]2_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2E388 mov eax, dword ptr fs:[00000030h]2_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5438F mov eax, dword ptr fs:[00000030h]2_2_02F5438F
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5438F mov eax, dword ptr fs:[00000030h]2_2_02F5438F
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD437C mov eax, dword ptr fs:[00000030h]2_2_02FD437C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB035C mov ecx, dword ptr fs:[00000030h]2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFA352 mov eax, dword ptr fs:[00000030h]2_2_02FFA352
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD8350 mov ecx, dword ptr fs:[00000030h]2_2_02FD8350
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030062D6 mov eax, dword ptr fs:[00000030h]2_2_030062D6
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2C310 mov ecx, dword ptr fs:[00000030h]2_2_02F2C310
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F50310 mov ecx, dword ptr fs:[00000030h]2_2_02F50310
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A30B mov eax, dword ptr fs:[00000030h]2_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A30B mov eax, dword ptr fs:[00000030h]2_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A30B mov eax, dword ptr fs:[00000030h]2_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2C0F0 mov eax, dword ptr fs:[00000030h]2_2_02F2C0F0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F720F0 mov ecx, dword ptr fs:[00000030h]2_2_02F720F0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2A0E3 mov ecx, dword ptr fs:[00000030h]2_2_02F2A0E3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F380E9 mov eax, dword ptr fs:[00000030h]2_2_02F380E9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB60E0 mov eax, dword ptr fs:[00000030h]2_2_02FB60E0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB20DE mov eax, dword ptr fs:[00000030h]2_2_02FB20DE
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF60B8 mov eax, dword ptr fs:[00000030h]2_2_02FF60B8
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF60B8 mov ecx, dword ptr fs:[00000030h]2_2_02FF60B8
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F280A0 mov eax, dword ptr fs:[00000030h]2_2_02F280A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC80A8 mov eax, dword ptr fs:[00000030h]2_2_02FC80A8
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004164 mov eax, dword ptr fs:[00000030h]2_2_03004164
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004164 mov eax, dword ptr fs:[00000030h]2_2_03004164
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3208A mov eax, dword ptr fs:[00000030h]2_2_02F3208A
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5C073 mov eax, dword ptr fs:[00000030h]2_2_02F5C073
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F32050 mov eax, dword ptr fs:[00000030h]2_2_02F32050
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6050 mov eax, dword ptr fs:[00000030h]2_2_02FB6050
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC6030 mov eax, dword ptr fs:[00000030h]2_2_02FC6030
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2A020 mov eax, dword ptr fs:[00000030h]2_2_02F2A020
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2C020 mov eax, dword ptr fs:[00000030h]2_2_02F2C020
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]2_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]2_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]2_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]2_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030061E5 mov eax, dword ptr fs:[00000030h]2_2_030061E5
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB4000 mov ecx, dword ptr fs:[00000030h]2_2_02FB4000
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F601F8 mov eax, dword ptr fs:[00000030h]2_2_02F601F8
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE1D0 mov ecx, dword ptr fs:[00000030h]2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF61C3 mov eax, dword ptr fs:[00000030h]2_2_02FF61C3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF61C3 mov eax, dword ptr fs:[00000030h]2_2_02FF61C3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]2_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]2_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]2_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]2_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2A197 mov eax, dword ptr fs:[00000030h]2_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2A197 mov eax, dword ptr fs:[00000030h]2_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2A197 mov eax, dword ptr fs:[00000030h]2_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F70185 mov eax, dword ptr fs:[00000030h]2_2_02F70185
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEC188 mov eax, dword ptr fs:[00000030h]2_2_02FEC188
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEC188 mov eax, dword ptr fs:[00000030h]2_2_02FEC188
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD4180 mov eax, dword ptr fs:[00000030h]2_2_02FD4180
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD4180 mov eax, dword ptr fs:[00000030h]2_2_02FD4180
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2C156 mov eax, dword ptr fs:[00000030h]2_2_02F2C156
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC8158 mov eax, dword ptr fs:[00000030h]2_2_02FC8158
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36154 mov eax, dword ptr fs:[00000030h]2_2_02F36154
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36154 mov eax, dword ptr fs:[00000030h]2_2_02F36154
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC4144 mov ecx, dword ptr fs:[00000030h]2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F60124 mov eax, dword ptr fs:[00000030h]2_2_02F60124
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDA118 mov ecx, dword ptr fs:[00000030h]2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDA118 mov eax, dword ptr fs:[00000030h]2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDA118 mov eax, dword ptr fs:[00000030h]2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDA118 mov eax, dword ptr fs:[00000030h]2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF0115 mov eax, dword ptr fs:[00000030h]2_2_02FF0115
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]2_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]2_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]2_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]2_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB06F1 mov eax, dword ptr fs:[00000030h]2_2_02FB06F1
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB06F1 mov eax, dword ptr fs:[00000030h]2_2_02FB06F1
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A6C7 mov ebx, dword ptr fs:[00000030h]2_2_02F6A6C7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A6C7 mov eax, dword ptr fs:[00000030h]2_2_02F6A6C7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F666B0 mov eax, dword ptr fs:[00000030h]2_2_02F666B0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C6A6 mov eax, dword ptr fs:[00000030h]2_2_02F6C6A6
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34690 mov eax, dword ptr fs:[00000030h]2_2_02F34690
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34690 mov eax, dword ptr fs:[00000030h]2_2_02F34690
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F62674 mov eax, dword ptr fs:[00000030h]2_2_02F62674
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF866E mov eax, dword ptr fs:[00000030h]2_2_02FF866E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF866E mov eax, dword ptr fs:[00000030h]2_2_02FF866E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A660 mov eax, dword ptr fs:[00000030h]2_2_02F6A660
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A660 mov eax, dword ptr fs:[00000030h]2_2_02F6A660
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4C640 mov eax, dword ptr fs:[00000030h]2_2_02F4C640
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4E627 mov eax, dword ptr fs:[00000030h]2_2_02F4E627
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F66620 mov eax, dword ptr fs:[00000030h]2_2_02F66620
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F68620 mov eax, dword ptr fs:[00000030h]2_2_02F68620
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3262C mov eax, dword ptr fs:[00000030h]2_2_02F3262C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72619 mov eax, dword ptr fs:[00000030h]2_2_02F72619
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAE609 mov eax, dword ptr fs:[00000030h]2_2_02FAE609
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F347FB mov eax, dword ptr fs:[00000030h]2_2_02F347FB
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F347FB mov eax, dword ptr fs:[00000030h]2_2_02F347FB
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F527ED mov eax, dword ptr fs:[00000030h]2_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F527ED mov eax, dword ptr fs:[00000030h]2_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F527ED mov eax, dword ptr fs:[00000030h]2_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBE7E1 mov eax, dword ptr fs:[00000030h]2_2_02FBE7E1
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3C7C0 mov eax, dword ptr fs:[00000030h]2_2_02F3C7C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB07C3 mov eax, dword ptr fs:[00000030h]2_2_02FB07C3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F307AF mov eax, dword ptr fs:[00000030h]2_2_02F307AF
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE47A0 mov eax, dword ptr fs:[00000030h]2_2_02FE47A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD678E mov eax, dword ptr fs:[00000030h]2_2_02FD678E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38770 mov eax, dword ptr fs:[00000030h]2_2_02F38770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30750 mov eax, dword ptr fs:[00000030h]2_2_02F30750
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBE75D mov eax, dword ptr fs:[00000030h]2_2_02FBE75D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72750 mov eax, dword ptr fs:[00000030h]2_2_02F72750
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F72750 mov eax, dword ptr fs:[00000030h]2_2_02F72750
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB4755 mov eax, dword ptr fs:[00000030h]2_2_02FB4755
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6674D mov esi, dword ptr fs:[00000030h]2_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6674D mov eax, dword ptr fs:[00000030h]2_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6674D mov eax, dword ptr fs:[00000030h]2_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6273C mov eax, dword ptr fs:[00000030h]2_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6273C mov ecx, dword ptr fs:[00000030h]2_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6273C mov eax, dword ptr fs:[00000030h]2_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAC730 mov eax, dword ptr fs:[00000030h]2_2_02FAC730
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C720 mov eax, dword ptr fs:[00000030h]2_2_02F6C720
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C720 mov eax, dword ptr fs:[00000030h]2_2_02F6C720
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30710 mov eax, dword ptr fs:[00000030h]2_2_02F30710
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F60710 mov eax, dword ptr fs:[00000030h]2_2_02F60710
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C700 mov eax, dword ptr fs:[00000030h]2_2_02F6C700
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F304E5 mov ecx, dword ptr fs:[00000030h]2_2_02F304E5
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F644B0 mov ecx, dword ptr fs:[00000030h]2_2_02F644B0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBA4B0 mov eax, dword ptr fs:[00000030h]2_2_02FBA4B0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F364AB mov eax, dword ptr fs:[00000030h]2_2_02F364AB
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEA49A mov eax, dword ptr fs:[00000030h]2_2_02FEA49A
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5A470 mov eax, dword ptr fs:[00000030h]2_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5A470 mov eax, dword ptr fs:[00000030h]2_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5A470 mov eax, dword ptr fs:[00000030h]2_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBC460 mov ecx, dword ptr fs:[00000030h]2_2_02FBC460
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FEA456 mov eax, dword ptr fs:[00000030h]2_2_02FEA456
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2645D mov eax, dword ptr fs:[00000030h]2_2_02F2645D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5245A mov eax, dword ptr fs:[00000030h]2_2_02F5245A
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A430 mov eax, dword ptr fs:[00000030h]2_2_02F6A430
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2E420 mov eax, dword ptr fs:[00000030h]2_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2E420 mov eax, dword ptr fs:[00000030h]2_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2E420 mov eax, dword ptr fs:[00000030h]2_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2C427 mov eax, dword ptr fs:[00000030h]2_2_02F2C427
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F68402 mov eax, dword ptr fs:[00000030h]2_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F68402 mov eax, dword ptr fs:[00000030h]2_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F68402 mov eax, dword ptr fs:[00000030h]2_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F325E0 mov eax, dword ptr fs:[00000030h]2_2_02F325E0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C5ED mov eax, dword ptr fs:[00000030h]2_2_02F6C5ED
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C5ED mov eax, dword ptr fs:[00000030h]2_2_02F6C5ED
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F365D0 mov eax, dword ptr fs:[00000030h]2_2_02F365D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A5D0 mov eax, dword ptr fs:[00000030h]2_2_02F6A5D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A5D0 mov eax, dword ptr fs:[00000030h]2_2_02F6A5D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E5CF mov eax, dword ptr fs:[00000030h]2_2_02F6E5CF
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E5CF mov eax, dword ptr fs:[00000030h]2_2_02F6E5CF
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F545B1 mov eax, dword ptr fs:[00000030h]2_2_02F545B1
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F545B1 mov eax, dword ptr fs:[00000030h]2_2_02F545B1
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB05A7 mov eax, dword ptr fs:[00000030h]2_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB05A7 mov eax, dword ptr fs:[00000030h]2_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB05A7 mov eax, dword ptr fs:[00000030h]2_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6E59C mov eax, dword ptr fs:[00000030h]2_2_02F6E59C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F32582 mov eax, dword ptr fs:[00000030h]2_2_02F32582
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F32582 mov ecx, dword ptr fs:[00000030h]2_2_02F32582
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F64588 mov eax, dword ptr fs:[00000030h]2_2_02F64588
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6656A mov eax, dword ptr fs:[00000030h]2_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6656A mov eax, dword ptr fs:[00000030h]2_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6656A mov eax, dword ptr fs:[00000030h]2_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38550 mov eax, dword ptr fs:[00000030h]2_2_02F38550
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38550 mov eax, dword ptr fs:[00000030h]2_2_02F38550
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC6500 mov eax, dword ptr fs:[00000030h]2_2_02FC6500
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004B00 mov eax, dword ptr fs:[00000030h]2_2_03004B00
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6AAEE mov eax, dword ptr fs:[00000030h]2_2_02F6AAEE
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6AAEE mov eax, dword ptr fs:[00000030h]2_2_02F6AAEE
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30AD0 mov eax, dword ptr fs:[00000030h]2_2_02F30AD0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F64AD0 mov eax, dword ptr fs:[00000030h]2_2_02F64AD0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F64AD0 mov eax, dword ptr fs:[00000030h]2_2_02F64AD0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F86ACC mov eax, dword ptr fs:[00000030h]2_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F86ACC mov eax, dword ptr fs:[00000030h]2_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F86ACC mov eax, dword ptr fs:[00000030h]2_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38AA0 mov eax, dword ptr fs:[00000030h]2_2_02F38AA0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38AA0 mov eax, dword ptr fs:[00000030h]2_2_02F38AA0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03002B57 mov eax, dword ptr fs:[00000030h]2_2_03002B57
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03002B57 mov eax, dword ptr fs:[00000030h]2_2_03002B57
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03002B57 mov eax, dword ptr fs:[00000030h]2_2_03002B57
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03002B57 mov eax, dword ptr fs:[00000030h]2_2_03002B57
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F86AA4 mov eax, dword ptr fs:[00000030h]2_2_02F86AA4
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F68A90 mov edx, dword ptr fs:[00000030h]2_2_02F68A90
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FACA72 mov eax, dword ptr fs:[00000030h]2_2_02FACA72
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FACA72 mov eax, dword ptr fs:[00000030h]2_2_02FACA72
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6CA6F mov eax, dword ptr fs:[00000030h]2_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6CA6F mov eax, dword ptr fs:[00000030h]2_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6CA6F mov eax, dword ptr fs:[00000030h]2_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDEA60 mov eax, dword ptr fs:[00000030h]2_2_02FDEA60
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40A5B mov eax, dword ptr fs:[00000030h]2_2_02F40A5B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40A5B mov eax, dword ptr fs:[00000030h]2_2_02F40A5B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F54A35 mov eax, dword ptr fs:[00000030h]2_2_02F54A35
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F54A35 mov eax, dword ptr fs:[00000030h]2_2_02F54A35
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6CA38 mov eax, dword ptr fs:[00000030h]2_2_02F6CA38
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6CA24 mov eax, dword ptr fs:[00000030h]2_2_02F6CA24
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5EA2E mov eax, dword ptr fs:[00000030h]2_2_02F5EA2E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBCA11 mov eax, dword ptr fs:[00000030h]2_2_02FBCA11
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38BF0 mov eax, dword ptr fs:[00000030h]2_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38BF0 mov eax, dword ptr fs:[00000030h]2_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F38BF0 mov eax, dword ptr fs:[00000030h]2_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5EBFC mov eax, dword ptr fs:[00000030h]2_2_02F5EBFC
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBCBF0 mov eax, dword ptr fs:[00000030h]2_2_02FBCBF0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDEBD0 mov eax, dword ptr fs:[00000030h]2_2_02FDEBD0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F50BCB mov eax, dword ptr fs:[00000030h]2_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F50BCB mov eax, dword ptr fs:[00000030h]2_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F50BCB mov eax, dword ptr fs:[00000030h]2_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30BCD mov eax, dword ptr fs:[00000030h]2_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30BCD mov eax, dword ptr fs:[00000030h]2_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30BCD mov eax, dword ptr fs:[00000030h]2_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40BBE mov eax, dword ptr fs:[00000030h]2_2_02F40BBE
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F40BBE mov eax, dword ptr fs:[00000030h]2_2_02F40BBE
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE4BB0 mov eax, dword ptr fs:[00000030h]2_2_02FE4BB0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE4BB0 mov eax, dword ptr fs:[00000030h]2_2_02FE4BB0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004A80 mov eax, dword ptr fs:[00000030h]2_2_03004A80
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F2CB7E mov eax, dword ptr fs:[00000030h]2_2_02F2CB7E
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F28B50 mov eax, dword ptr fs:[00000030h]2_2_02F28B50
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FDEB50 mov eax, dword ptr fs:[00000030h]2_2_02FDEB50
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE4B4B mov eax, dword ptr fs:[00000030h]2_2_02FE4B4B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FE4B4B mov eax, dword ptr fs:[00000030h]2_2_02FE4B4B
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC6B40 mov eax, dword ptr fs:[00000030h]2_2_02FC6B40
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC6B40 mov eax, dword ptr fs:[00000030h]2_2_02FC6B40
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFAB40 mov eax, dword ptr fs:[00000030h]2_2_02FFAB40
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD8B42 mov eax, dword ptr fs:[00000030h]2_2_02FD8B42
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5EB20 mov eax, dword ptr fs:[00000030h]2_2_02F5EB20
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5EB20 mov eax, dword ptr fs:[00000030h]2_2_02F5EB20
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF8B28 mov eax, dword ptr fs:[00000030h]2_2_02FF8B28
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FF8B28 mov eax, dword ptr fs:[00000030h]2_2_02FF8B28
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C8F9 mov eax, dword ptr fs:[00000030h]2_2_02F6C8F9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6C8F9 mov eax, dword ptr fs:[00000030h]2_2_02F6C8F9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFA8E4 mov eax, dword ptr fs:[00000030h]2_2_02FFA8E4
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F5E8C0 mov eax, dword ptr fs:[00000030h]2_2_02F5E8C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03004940 mov eax, dword ptr fs:[00000030h]2_2_03004940
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBC89D mov eax, dword ptr fs:[00000030h]2_2_02FBC89D
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F30887 mov eax, dword ptr fs:[00000030h]2_2_02F30887
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBE872 mov eax, dword ptr fs:[00000030h]2_2_02FBE872
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBE872 mov eax, dword ptr fs:[00000030h]2_2_02FBE872
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC6870 mov eax, dword ptr fs:[00000030h]2_2_02FC6870
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC6870 mov eax, dword ptr fs:[00000030h]2_2_02FC6870
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F60854 mov eax, dword ptr fs:[00000030h]2_2_02F60854
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34859 mov eax, dword ptr fs:[00000030h]2_2_02F34859
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F34859 mov eax, dword ptr fs:[00000030h]2_2_02F34859
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F42840 mov ecx, dword ptr fs:[00000030h]2_2_02F42840
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52835 mov ecx, dword ptr fs:[00000030h]2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F6A830 mov eax, dword ptr fs:[00000030h]2_2_02F6A830
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD483A mov eax, dword ptr fs:[00000030h]2_2_02FD483A
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD483A mov eax, dword ptr fs:[00000030h]2_2_02FD483A
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBC810 mov eax, dword ptr fs:[00000030h]2_2_02FBC810
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F629F9 mov eax, dword ptr fs:[00000030h]2_2_02F629F9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F629F9 mov eax, dword ptr fs:[00000030h]2_2_02F629F9
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBE9E0 mov eax, dword ptr fs:[00000030h]2_2_02FBE9E0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F649D0 mov eax, dword ptr fs:[00000030h]2_2_02F649D0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FFA9D3 mov eax, dword ptr fs:[00000030h]2_2_02FFA9D3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FC69C0 mov eax, dword ptr fs:[00000030h]2_2_02FC69C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB89B3 mov esi, dword ptr fs:[00000030h]2_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB89B3 mov eax, dword ptr fs:[00000030h]2_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FB89B3 mov eax, dword ptr fs:[00000030h]2_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F309AD mov eax, dword ptr fs:[00000030h]2_2_02F309AD
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F309AD mov eax, dword ptr fs:[00000030h]2_2_02F309AD
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD4978 mov eax, dword ptr fs:[00000030h]2_2_02FD4978
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FD4978 mov eax, dword ptr fs:[00000030h]2_2_02FD4978
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02FBC97C mov eax, dword ptr fs:[00000030h]2_2_02FBC97C
Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_02F56962 mov eax, dword ptr fs:[00000030h]2_2_02F56962
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_00426DA1
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2261008Jump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_00436431
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe"Jump to behavior
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
Source: PGHPC-10-0033-FZB-001.exeBinary or memory string: Shell_TrayWnd
Source: PGHPC-10-0033-FZB-001.exeBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,0_2_0042039F
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
Source: PGHPC-10-0033-FZB-001.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
Source: PGHPC-10-0033-FZB-001.exeBinary or memory string: WIN_XP
Source: PGHPC-10-0033-FZB-001.exeBinary or memory string: WIN_XPe
Source: PGHPC-10-0033-FZB-001.exeBinary or memory string: WIN_VISTA
Source: PGHPC-10-0033-FZB-001.exeBinary or memory string: WIN_7
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
Source: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exeCode function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure2
Valid Accounts
3
Native API
2
Valid Accounts
2
Valid Accounts
2
Valid Accounts
21
Input Capture
2
System Time Discovery
Remote Services21
Input Capture
1
Encrypted Channel
Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading
1
Exploitation for Privilege Escalation
1
Disable or Modify Tools
LSASS Memory24
Security Software Discovery
Remote Desktop Protocol1
Archive Collected Data
1
Ingress Tool Transfer
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)21
Access Token Manipulation
2
Virtualization/Sandbox Evasion
Security Account Manager2
Virtualization/Sandbox Evasion
SMB/Windows Admin Shares3
Clipboard Data
SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook212
Process Injection
21
Access Token Manipulation
NTDS3
Process Discovery
Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
DLL Side-Loading
212
Process Injection
LSA Secrets1
Application Window Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Deobfuscate/Decode Files or Information
Cached Domain Credentials1
Account Discovery
VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
Obfuscated Files or Information
DCSync1
System Owner/User Discovery
Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
DLL Side-Loading
Proc Filesystem2
File and Directory Discovery
Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow115
System Information Discovery
Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
PGHPC-10-0033-FZB-001.exe47%ReversingLabsWin32.Trojan.AgentTesla
PGHPC-10-0033-FZB-001.exe100%AviraTR/AD.Swotter.svrhy
PGHPC-10-0033-FZB-001.exe100%Joe Sandbox ML
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
No contacted IP infos
Joe Sandbox version:41.0.0 Charoite
Analysis ID:1538507
Start date and time:2024-10-21 13:20:51 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 48s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:15
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:PGHPC-10-0033-FZB-001.exe
Detection:MAL
Classification:mal80.evad.winEXE@3/1@0/0
EGA Information:
  • Successful, ratio: 100%
HCA Information:
  • Successful, ratio: 97%
  • Number of executed functions: 37
  • Number of non-executed functions: 317
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
  • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
  • Not all processes where analyzed, report is missing behavior information
  • Report size exceeded maximum capacity and may have missing disassembly code.
  • VT rate limit hit for: PGHPC-10-0033-FZB-001.exe
TimeTypeDescription
07:22:07API Interceptor3x Sleep call for process: svchost.exe modified
No context
No context
No context
No context
No context
Process:C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe
File Type:data
Category:modified
Size (bytes):287744
Entropy (8bit):7.994015215702731
Encrypted:true
SSDEEP:6144:jDhiD0v8PIxFh84A0414xATAWLYJ0iIEGOocT2RSH9cvtO1V:XhiD0EA3h8DTAWk+tEGVcT2RSdN1V
MD5:9EA32B05A25001B91DB346D52799843F
SHA1:1DA9FF77BD3E6F12C39566B721131FA31A51B02A
SHA-256:1B73BA878D5A9238B9D77B90D1FC71AB289C0B3D0286482F9AA02BB12FD98462
SHA-512:E7C4E3DD12CE17CE4F361E1120DDFF55B74B1EE279EBC2D7E0A50E4634FD75A2AB82D639C036FC97744F0FC12C182546DC8854CB3F1F078650F5F6D71934F514
Malicious:false
Reputation:low
Preview:.hu..NK1O...J.....2M...pT=...R20C2NK1OXW5CLPR20C2NK1OXW5CLP.20C<Q.?O.^.b.Q....Z'8.?*8R1-=rQQ-\!?.-=wG6"p;\..}.k\ <2.NAZv20C2NK16Y^.~,7..P$.s+V.B.v05.*.wQ(.M..l2U..[-#./?.5CLPR20Cb.K1.YV5..j.20C2NK1O.W7BGQY20.6NK1OXW5CL.F20C"NK1?\W5C.PR"0C2LK1IXW5CLPR40C2NK1OX'1CLRR20C2NI1..W5SLPB20C2^K1_XW5CLPB20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5m85*F0C2..5OXG5CL.V20S2NK1OXW5CLPR20c2N+1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OXW5CLPR20C2NK1OX
File type:PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):7.518668968404846
TrID:
  • Win32 Executable (generic) a (10002005/4) 95.11%
  • AutoIt3 compiled script executable (510682/80) 4.86%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:PGHPC-10-0033-FZB-001.exe
File size:1'338'893 bytes
MD5:6d23798eb1eceea0adbe86cef808093b
SHA1:e738ac1d5d53966aa14fd4bd5cb2931d7b1c81c3
SHA256:fd6e6fe49c241c128dec23aa859485c80db889758300a8c4f86f2c404dadf264
SHA512:1a8cae90a15c9c5569a3875d2bd46b3c21c2fb42bfd8da205f94c4365374615b74e27ee42b5844eb51895ea7b1a60ecc04dbdfe8f046ffd9044d3116465ae770
SSDEEP:24576:ffmMv6Ckr7Mny5QLkExRo+p+xVqscXNrZ9WCY:f3v+7/5QLkGiss4NDWCY
TLSH:DC55F212F3D680B6D9A339B0297BE36BEB3575154323C4CBA7E01E778E211509B36761
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........
Icon Hash:1733312925935517
Entrypoint:0x416310
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x400000
Subsystem:windows gui
Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:TERMINAL_SERVER_AWARE
Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:5
OS Version Minor:0
File Version Major:5
File Version Minor:0
Subsystem Version Major:5
Subsystem Version Minor:0
Import Hash:aaaa8913c89c8aa4a5d93f06853894da
Instruction
call 00007F9490B95B8Ch
jmp 00007F9490B8995Eh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F9490B89AEAh
cmp edi, eax
jc 00007F9490B89C8Ah
cmp ecx, 00000100h
jc 00007F9490B89B01h
cmp dword ptr [004A94E0h], 00000000h
je 00007F9490B89AF8h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F9490B89AEAh
pop esi
pop edi
pop ebp
jmp 00007F9490B89F4Ah
test edi, 00000003h
jne 00007F9490B89AF7h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F9490B89B0Ch
rep movsd
jmp dword ptr [00416494h+edx*4]
nop
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F9490B89AEEh
and eax, 03h
add ecx, eax
jmp dword ptr [004163A8h+eax*4]
jmp dword ptr [004164A4h+ecx*4]
nop
jmp dword ptr [00416428h+ecx*4]
nop
mov eax, E4004163h
arpl word ptr [ecx+00h], ax
or byte ptr [ecx+eax*2+00h], ah
and edx, ecx
mov al, byte ptr [esi]
mov byte ptr [edi], al
mov al, byte ptr [esi+01h]
mov byte ptr [edi+01h], al
mov al, byte ptr [esi+02h]
shr ecx, 02h
mov byte ptr [edi+02h], al
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F9490B89AAEh
Programming Language:
  • [ASM] VS2008 SP1 build 30729
  • [ C ] VS2008 SP1 build 30729
  • [C++] VS2008 SP1 build 30729
  • [ C ] VS2005 build 50727
  • [IMP] VS2005 build 50727
  • [ASM] VS2008 build 21022
  • [RES] VS2008 build 21022
  • [LNK] VS2008 SP1 build 30729
NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x8cd3c0x154.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9298.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x820000x840.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x800170x802006c20c6bf686768b6f134f5bd508171bcFalse0.5602991615853659data6.634688230255595IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata0x820000xd95c0xda00f979966509a93083729d23cdfd2a6f2dFalse0.36256450688073394data4.880040824124099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data0x900000x1a5180x6800e5d77411f751d28c6eee48a743606795False0.1600060096153846data2.2017649896261107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc0xab0000x92980x9400f6be76de0ef2c68f397158bf01bdef3eFalse0.4896801097972973data5.530303089784181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
NameRVASizeTypeLanguageCountryZLIB Complexity
RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
RT_STRING0xb28380x43adataEnglishGreat Britain0.3733826247689464
RT_STRING0xb2c780x5fcdataEnglishGreat Britain0.3087467362924282
RT_STRING0xb32780x65cdataEnglishGreat Britain0.34336609336609336
RT_STRING0xb38d80x388dataEnglishGreat Britain0.377212389380531
RT_STRING0xb3c600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
RT_GROUP_ICON0xb3db80x84dataEnglishGreat Britain0.6439393939393939
RT_GROUP_ICON0xb3e400x14dataEnglishGreat Britain1.15
RT_GROUP_ICON0xb3e580x14dataEnglishGreat Britain1.25
RT_GROUP_ICON0xb3e700x14dataEnglishGreat Britain1.25
RT_VERSION0xb3e880x19cdataEnglishGreat Britain0.5339805825242718
RT_MANIFEST0xb40280x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581
DLLImport
WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
GDI32.dllDeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
OLEAUT32.dllSafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData
Language of compilation systemCountry where language is spokenMap
EnglishGreat Britain
EnglishUnited States
No network behavior found

Click to jump to process

Click to jump to process

Click to dive into process behavior distribution

Click to jump to process

Target ID:0
Start time:07:21:43
Start date:21/10/2024
Path:C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe"
Imagebase:0x400000
File size:1'338'893 bytes
MD5 hash:6D23798EB1ECEEA0ADBE86CEF808093B
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
Has exited:true

Target ID:2
Start time:07:21:44
Start date:21/10/2024
Path:C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe"
Imagebase:0x180000
File size:46'504 bytes
MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

Reset < >

    Execution Graph

    Execution Coverage:3%
    Dynamic/Decrypted Code Coverage:1.3%
    Signature Coverage:3.8%
    Total number of Nodes:1409
    Total number of Limit Nodes:31
    execution_graph 84762 429212 84767 410b90 84762->84767 84768 410b9a __write_nolock 84767->84768 84787 41171a 84768->84787 84772 410c66 _wcsncat 84802 413e3c 84772->84802 84775 41171a 75 API calls 84776 410ca3 _wcscpy 84775->84776 84777 410cd1 RegOpenKeyExW 84776->84777 84778 429bc3 RegQueryValueExW 84777->84778 84779 410cf7 84777->84779 84780 429cd9 RegCloseKey 84778->84780 84782 429bf2 _wcscat _wcslen _wcsncpy 84778->84782 84784 411421 84779->84784 84781 41171a 75 API calls 84781->84782 84782->84781 84783 429cd8 84782->84783 84783->84780 84877 4113e5 84784->84877 84786 41142e 84789 411724 84787->84789 84790 410c31 GetModuleFileNameW 84789->84790 84793 411740 std::bad_alloc::bad_alloc 84789->84793 84805 4138ba 84789->84805 84823 411afc 6 API calls __decode_pointer 84789->84823 84799 413db0 84790->84799 84795 411421 __cinit 74 API calls 84793->84795 84797 411766 84793->84797 84794 411770 84825 41805b RaiseException 84794->84825 84795->84797 84824 4116fd 67 API calls std::exception::exception 84797->84824 84798 41177e 84835 413b95 84799->84835 84865 41abec 84802->84865 84806 41396d 84805->84806 84819 4138cc 84805->84819 84833 411afc 6 API calls __decode_pointer 84806->84833 84808 413973 84834 417f23 67 API calls __getptd_noexit 84808->84834 84813 413929 RtlAllocateHeap 84813->84819 84815 4138dd 84815->84819 84826 418252 67 API calls 2 library calls 84815->84826 84827 4180a7 67 API calls 7 library calls 84815->84827 84828 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84815->84828 84816 413959 84831 417f23 67 API calls __getptd_noexit 84816->84831 84819->84813 84819->84815 84819->84816 84820 41395e 84819->84820 84822 413965 84819->84822 84829 41386b 67 API calls 4 library calls 84819->84829 84830 411afc 6 API calls __decode_pointer 84819->84830 84832 417f23 67 API calls __getptd_noexit 84820->84832 84822->84789 84823->84789 84824->84794 84825->84798 84826->84815 84827->84815 84829->84819 84830->84819 84831->84820 84832->84822 84833->84808 84834->84822 84838 413c2f 84835->84838 84842 413bae 84835->84842 84836 413d60 84861 417f23 67 API calls __getptd_noexit 84836->84861 84837 413d7b 84863 417f23 67 API calls __getptd_noexit 84837->84863 84838->84836 84838->84837 84841 413d65 84846 413cfb 84841->84846 84862 417ebb 6 API calls 2 library calls 84841->84862 84842->84838 84851 413c1d 84842->84851 84857 41ab19 67 API calls ___wstrgtold12_l 84842->84857 84845 413d03 84845->84838 84845->84846 84848 413d8e 84845->84848 84846->84772 84847 413cb9 84847->84838 84849 413cd6 84847->84849 84859 41ab19 67 API calls ___wstrgtold12_l 84847->84859 84864 41ab19 67 API calls ___wstrgtold12_l 84848->84864 84849->84838 84849->84846 84853 413cef 84849->84853 84851->84838 84856 413c9b 84851->84856 84858 41ab19 67 API calls ___wstrgtold12_l 84851->84858 84860 41ab19 67 API calls ___wstrgtold12_l 84853->84860 84856->84845 84856->84847 84857->84851 84858->84856 84859->84849 84860->84846 84861->84841 84863->84841 84864->84846 84866 41ac02 84865->84866 84867 41abfd 84865->84867 84874 417f23 67 API calls __getptd_noexit 84866->84874 84867->84866 84870 41ac22 84867->84870 84869 41ac07 84875 417ebb 6 API calls 2 library calls 84869->84875 84873 410c99 84870->84873 84876 417f23 67 API calls __getptd_noexit 84870->84876 84873->84775 84874->84869 84876->84869 84878 4113f1 __read 84877->84878 84885 41181b 84878->84885 84884 411412 __read 84884->84786 84911 418407 84885->84911 84887 4113f6 84888 4112fa 84887->84888 84976 4169e9 TlsGetValue 84888->84976 84891 4169e9 __decode_pointer 6 API calls 84892 41131e 84891->84892 84903 4113a1 84892->84903 84986 4170e7 68 API calls 5 library calls 84892->84986 84894 41696e __encode_pointer 6 API calls 84896 411396 84894->84896 84895 41133c 84897 411357 84895->84897 84898 411366 84895->84898 84907 411388 84895->84907 84901 41696e __encode_pointer 6 API calls 84896->84901 84987 417047 73 API calls _realloc 84897->84987 84900 411360 84898->84900 84898->84903 84900->84898 84904 41137c 84900->84904 84988 417047 73 API calls _realloc 84900->84988 84901->84903 84908 41141b 84903->84908 84989 41696e TlsGetValue 84904->84989 84905 411376 84905->84903 84905->84904 84907->84894 85001 411824 84908->85001 84912 41841c 84911->84912 84913 41842f EnterCriticalSection 84911->84913 84918 418344 84912->84918 84913->84887 84915 418422 84915->84913 84946 4117af 67 API calls 3 library calls 84915->84946 84917 41842e 84917->84913 84919 418350 __read 84918->84919 84920 418360 84919->84920 84921 418378 84919->84921 84947 418252 67 API calls 2 library calls 84920->84947 84927 418386 __read 84921->84927 84950 416fb6 84921->84950 84923 418365 84948 4180a7 67 API calls 7 library calls 84923->84948 84927->84915 84928 41836c 84949 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84928->84949 84929 4183a7 84933 418407 __lock 67 API calls 84929->84933 84930 418398 84956 417f23 67 API calls __getptd_noexit 84930->84956 84935 4183ae 84933->84935 84936 4183e2 84935->84936 84937 4183b6 84935->84937 84939 413a88 ___free_lconv_num 67 API calls 84936->84939 84957 4189e6 InitializeCriticalSectionAndSpinCount __read 84937->84957 84941 4183d3 84939->84941 84940 4183c1 84940->84941 84958 413a88 84940->84958 84972 4183fe LeaveCriticalSection _doexit 84941->84972 84944 4183cd 84971 417f23 67 API calls __getptd_noexit 84944->84971 84946->84917 84947->84923 84948->84928 84953 416fbf 84950->84953 84951 4138ba _malloc 66 API calls 84951->84953 84952 416ff5 84952->84929 84952->84930 84953->84951 84953->84952 84954 416fd6 Sleep 84953->84954 84955 416feb 84954->84955 84955->84952 84955->84953 84956->84927 84957->84940 84960 413a94 __read 84958->84960 84959 413b0d __dosmaperr __read 84959->84944 84960->84959 84961 413ad3 84960->84961 84963 418407 __lock 65 API calls 84960->84963 84961->84959 84962 413ae8 RtlFreeHeap 84961->84962 84962->84959 84964 413afa 84962->84964 84965 413aab ___sbh_find_block 84963->84965 84975 417f23 67 API calls __getptd_noexit 84964->84975 84968 413ac5 84965->84968 84973 419f9d __VEC_memcpy VirtualFree VirtualFree HeapFree __cftoe2_l 84965->84973 84967 413aff GetLastError 84967->84959 84974 413ade LeaveCriticalSection _doexit 84968->84974 84971->84941 84972->84927 84973->84968 84974->84961 84975->84967 84977 416a01 84976->84977 84978 416a22 GetModuleHandleW 84976->84978 84977->84978 84981 416a0b TlsGetValue 84977->84981 84979 416a32 84978->84979 84980 416a3d GetProcAddress 84978->84980 84999 41177f Sleep GetModuleHandleW 84979->84999 84983 41130e 84980->84983 84984 416a16 84981->84984 84983->84891 84984->84978 84984->84983 84985 416a38 84985->84980 84985->84983 84986->84895 84987->84900 84988->84905 84990 4169a7 GetModuleHandleW 84989->84990 84991 416986 84989->84991 84993 4169c2 GetProcAddress 84990->84993 84994 4169b7 84990->84994 84991->84990 84992 416990 TlsGetValue 84991->84992 84997 41699b 84992->84997 84996 41699f 84993->84996 85000 41177f Sleep GetModuleHandleW 84994->85000 84996->84907 84997->84990 84997->84996 84998 4169bd 84998->84993 84998->84996 84999->84985 85000->84998 85004 41832d LeaveCriticalSection 85001->85004 85003 411420 85003->84884 85004->85003 85005 409030 85019 409110 117 API calls 85005->85019 85007 42ceb6 85033 410ae0 VariantClear ctype 85007->85033 85009 40906e 85009->85007 85011 42cea9 85009->85011 85013 4090a4 85009->85013 85010 42cebf 85032 45e62e 116 API calls 3 library calls 85011->85032 85020 404160 85013->85020 85016 4090f0 ctype 85018 4090be ctype 85018->85016 85028 4092c0 85018->85028 85019->85009 85021 4092c0 VariantClear 85020->85021 85022 40416e 85021->85022 85034 404120 85022->85034 85024 40419b 85038 4734b7 85024->85038 85082 40efe0 85024->85082 85025 4041c6 85025->85007 85025->85018 85029 4092c8 ctype 85028->85029 85030 429db0 VariantClear 85029->85030 85031 4092d5 ctype 85029->85031 85030->85031 85031->85018 85032->85007 85033->85010 85035 40412e 85034->85035 85036 4092c0 VariantClear 85035->85036 85037 404138 85036->85037 85037->85024 85090 453063 85038->85090 85041 473545 85094 463c42 85041->85094 85042 47350c 85043 4092c0 VariantClear 85042->85043 85050 473514 85043->85050 85045 473558 85046 47355c 85045->85046 85063 473595 85045->85063 85047 4092c0 VariantClear 85046->85047 85056 473564 85047->85056 85048 473616 85107 463d7e 85048->85107 85050->85025 85051 473622 85053 473697 85051->85053 85054 47362c 85051->85054 85052 453063 111 API calls 85052->85063 85141 457838 85053->85141 85057 4092c0 VariantClear 85054->85057 85056->85025 85060 473634 85057->85060 85060->85025 85062 473655 85065 4092c0 VariantClear 85062->85065 85063->85048 85063->85052 85063->85062 85153 462f5a 87 API calls __wcsicoll 85063->85153 85075 47365d 85065->85075 85066 4736b0 85154 45e62e 116 API calls 3 library calls 85066->85154 85067 4736c9 85155 40e7e0 76 API calls 85067->85155 85070 4736ba GetCurrentProcess TerminateProcess 85070->85067 85071 4736db 85078 4736ff 85071->85078 85156 40d030 76 API calls 85071->85156 85072 473731 85079 473744 FreeLibrary 85072->85079 85080 47374b 85072->85080 85074 4736f1 85157 46b945 134 API calls 2 library calls 85074->85157 85075->85025 85078->85072 85158 40d030 76 API calls 85078->85158 85159 46b945 134 API calls 2 library calls 85078->85159 85079->85080 85080->85025 85083 40eff5 CreateFileW 85082->85083 85084 4299bf 85082->85084 85085 40f017 85083->85085 85084->85085 85086 4299c4 CreateFileW 85084->85086 85085->85025 85086->85085 85087 4299ea 85086->85087 85204 40e0d0 SetFilePointerEx SetFilePointerEx 85087->85204 85089 4299f5 85089->85085 85091 45306e 85090->85091 85092 45307a 85090->85092 85091->85092 85160 452e2a 111 API calls 5 library calls 85091->85160 85092->85041 85092->85042 85161 45335b 76 API calls 85094->85161 85096 463c5d 85162 442c52 80 API calls _wcslen 85096->85162 85098 463c72 85105 463cac 85098->85105 85163 40c060 85098->85163 85103 463ca4 85169 40c740 85103->85169 85106 463cf7 85105->85106 85174 462f5a 87 API calls __wcsicoll 85105->85174 85106->85045 85108 453063 111 API calls 85107->85108 85109 463d99 85108->85109 85110 463de0 85109->85110 85111 463dca 85109->85111 85186 40c760 78 API calls 85110->85186 85185 453081 111 API calls 85111->85185 85114 463de7 85129 463e19 85114->85129 85187 40c760 78 API calls 85114->85187 85115 463dd0 LoadLibraryW 85116 463e09 85115->85116 85118 463e3e 85116->85118 85116->85129 85120 463e4e 85118->85120 85121 463e7b 85118->85121 85119 463dfb 85119->85129 85188 40c760 78 API calls 85119->85188 85189 40d500 75 API calls 85120->85189 85191 40c760 78 API calls 85121->85191 85125 463e57 85190 45efe7 77 API calls ctype 85125->85190 85126 463e82 GetProcAddress 85130 463e90 85126->85130 85128 463e62 GetProcAddress 85132 463e79 85128->85132 85129->85051 85130->85129 85131 463edf 85130->85131 85130->85132 85131->85129 85135 463eef FreeLibrary 85131->85135 85132->85130 85192 403470 75 API calls _memcpy_s 85132->85192 85134 463eb4 85193 40d500 75 API calls 85134->85193 85135->85129 85137 463ebd 85194 45efe7 77 API calls ctype 85137->85194 85139 463ec8 GetProcAddress 85195 401330 ctype 85139->85195 85142 457a4c 85141->85142 85144 45785f _strcat _wcslen _wcscpy ctype 85141->85144 85149 410d40 85142->85149 85143 40c760 78 API calls 85143->85144 85144->85142 85144->85143 85145 453081 111 API calls 85144->85145 85146 443576 78 API calls 85144->85146 85147 4138ba 67 API calls _malloc 85144->85147 85196 40f580 85144->85196 85145->85144 85146->85144 85147->85144 85150 410d55 85149->85150 85151 410ded VirtualProtect 85150->85151 85152 410dbb 85150->85152 85151->85152 85152->85066 85152->85067 85153->85063 85154->85070 85155->85071 85156->85074 85157->85078 85158->85078 85159->85078 85160->85092 85161->85096 85162->85098 85164 41171a 75 API calls 85163->85164 85165 40c088 85164->85165 85166 41171a 75 API calls 85165->85166 85167 40c096 85166->85167 85168 4608ce 75 API calls _memcpy_s 85167->85168 85168->85103 85170 40c752 85169->85170 85171 40c747 85169->85171 85170->85105 85171->85170 85175 402ae0 85171->85175 85173 42a572 _memcpy_s 85173->85105 85174->85106 85176 42a06a 85175->85176 85177 402aef 85175->85177 85182 401380 85176->85182 85177->85173 85179 42a072 85180 41171a 75 API calls 85179->85180 85181 42a095 _memcpy_s 85180->85181 85181->85173 85183 41171a 75 API calls 85182->85183 85184 401387 85183->85184 85184->85179 85185->85115 85186->85114 85187->85119 85188->85116 85189->85125 85190->85128 85191->85126 85192->85134 85193->85137 85194->85139 85195->85131 85197 429440 85196->85197 85198 40f589 _wcslen 85196->85198 85199 40f58f WideCharToMultiByte 85198->85199 85200 40f5d8 85199->85200 85201 40f5ad 85199->85201 85200->85144 85202 41171a 75 API calls 85201->85202 85203 40f5bb WideCharToMultiByte 85202->85203 85203->85144 85204->85089 85205 4444e4 85210 40d900 85205->85210 85207 4444ee 85214 43723d 85207->85214 85209 444504 85211 40d917 85210->85211 85212 40d909 85210->85212 85211->85212 85213 40d91c CloseHandle 85211->85213 85212->85207 85213->85207 85215 40d900 CloseHandle 85214->85215 85216 437247 ctype 85215->85216 85216->85209 85217 4034b0 85218 4034b9 85217->85218 85219 4034bd 85217->85219 85220 42a0ba 85219->85220 85221 41171a 75 API calls 85219->85221 85222 4034fe _memcpy_s ctype 85221->85222 85223 40f110 RegOpenKeyExW 85224 40f13c RegQueryValueExW RegCloseKey 85223->85224 85225 40f15f 85223->85225 85224->85225 85226 416193 85263 41718c 85226->85263 85228 41619f GetStartupInfoW 85230 4161c2 85228->85230 85264 41aa31 HeapCreate 85230->85264 85232 416212 85266 416e29 GetModuleHandleW 85232->85266 85236 416223 __RTC_Initialize 85300 41b669 85236->85300 85239 416231 85240 41623d GetCommandLineW 85239->85240 85369 4117af 67 API calls 3 library calls 85239->85369 85315 42235f GetEnvironmentStringsW 85240->85315 85243 41623c 85243->85240 85244 41624c 85321 4222b1 GetModuleFileNameW 85244->85321 85246 416256 85247 416261 85246->85247 85370 4117af 67 API calls 3 library calls 85246->85370 85325 422082 85247->85325 85253 416272 85338 41186e 85253->85338 85254 416279 85256 416284 __wwincmdln 85254->85256 85372 4117af 67 API calls 3 library calls 85254->85372 85344 40d7f0 85256->85344 85259 4162b3 85374 411a4b 67 API calls _doexit 85259->85374 85262 4162b8 __read 85263->85228 85265 416206 85264->85265 85265->85232 85367 41616a 67 API calls 3 library calls 85265->85367 85267 416e44 85266->85267 85268 416e3d 85266->85268 85270 416fac 85267->85270 85271 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 85267->85271 85375 41177f Sleep GetModuleHandleW 85268->85375 85385 416ad5 70 API calls 2 library calls 85270->85385 85273 416e97 TlsAlloc 85271->85273 85272 416e43 85272->85267 85276 416218 85273->85276 85277 416ee5 TlsSetValue 85273->85277 85276->85236 85368 41616a 67 API calls 3 library calls 85276->85368 85277->85276 85278 416ef6 85277->85278 85376 411a69 6 API calls 4 library calls 85278->85376 85280 416efb 85281 41696e __encode_pointer 6 API calls 85280->85281 85282 416f06 85281->85282 85283 41696e __encode_pointer 6 API calls 85282->85283 85284 416f16 85283->85284 85285 41696e __encode_pointer 6 API calls 85284->85285 85286 416f26 85285->85286 85287 41696e __encode_pointer 6 API calls 85286->85287 85288 416f36 85287->85288 85377 41828b InitializeCriticalSectionAndSpinCount __alloc_osfhnd 85288->85377 85290 416f43 85290->85270 85291 4169e9 __decode_pointer 6 API calls 85290->85291 85292 416f57 85291->85292 85292->85270 85378 416ffb 85292->85378 85295 4169e9 __decode_pointer 6 API calls 85296 416f8a 85295->85296 85296->85270 85297 416f91 85296->85297 85384 416b12 67 API calls 5 library calls 85297->85384 85299 416f99 GetCurrentThreadId 85299->85276 85404 41718c 85300->85404 85302 41b675 GetStartupInfoA 85303 416ffb __calloc_crt 67 API calls 85302->85303 85304 41b696 85303->85304 85305 41b8b4 __read 85304->85305 85307 416ffb __calloc_crt 67 API calls 85304->85307 85310 41b7fb 85304->85310 85312 41b77e 85304->85312 85305->85239 85306 41b831 GetStdHandle 85306->85310 85307->85304 85308 41b896 SetHandleCount 85308->85305 85309 41b843 GetFileType 85309->85310 85310->85305 85310->85306 85310->85308 85310->85309 85406 4189e6 InitializeCriticalSectionAndSpinCount __read 85310->85406 85312->85305 85312->85310 85313 41b7a7 GetFileType 85312->85313 85405 4189e6 InitializeCriticalSectionAndSpinCount __read 85312->85405 85313->85312 85316 422370 85315->85316 85317 422374 85315->85317 85316->85244 85318 416fb6 __malloc_crt 67 API calls 85317->85318 85320 422395 _memcpy_s 85318->85320 85319 42239c FreeEnvironmentStringsW 85319->85244 85320->85319 85322 4222e6 _wparse_cmdline 85321->85322 85323 416fb6 __malloc_crt 67 API calls 85322->85323 85324 422329 _wparse_cmdline 85322->85324 85323->85324 85324->85246 85326 42209a _wcslen 85325->85326 85330 416267 85325->85330 85327 416ffb __calloc_crt 67 API calls 85326->85327 85333 4220be _wcslen 85327->85333 85328 422123 85329 413a88 ___free_lconv_num 67 API calls 85328->85329 85329->85330 85330->85253 85371 4117af 67 API calls 3 library calls 85330->85371 85331 416ffb __calloc_crt 67 API calls 85331->85333 85332 422149 85334 413a88 ___free_lconv_num 67 API calls 85332->85334 85333->85328 85333->85330 85333->85331 85333->85332 85336 422108 85333->85336 85407 426349 67 API calls ___wstrgtold12_l 85333->85407 85334->85330 85336->85333 85408 417d93 10 API calls 3 library calls 85336->85408 85339 41187c __IsNonwritableInCurrentImage 85338->85339 85409 418486 85339->85409 85341 41189a __initterm_e 85342 411421 __cinit 74 API calls 85341->85342 85343 4118b9 __IsNonwritableInCurrentImage __initterm 85341->85343 85342->85343 85343->85254 85345 431bcb 85344->85345 85346 40d80c 85344->85346 85347 4092c0 VariantClear 85346->85347 85348 40d847 85347->85348 85413 40eb50 85348->85413 85353 40d877 85416 411ac6 67 API calls 4 library calls 85353->85416 85354 40d888 85417 411b24 67 API calls ___wstrgtold12_l 85354->85417 85356 40d891 85418 40f370 SystemParametersInfoW SystemParametersInfoW 85356->85418 85358 40d89f 85419 40d6d0 GetCurrentDirectoryW 85358->85419 85360 40d8a7 SystemParametersInfoW 85361 40d8d4 85360->85361 85362 40d8cd FreeLibrary 85360->85362 85363 4092c0 VariantClear 85361->85363 85362->85361 85364 40d8dd 85363->85364 85365 4092c0 VariantClear 85364->85365 85366 40d8e6 85365->85366 85366->85259 85373 411a1f 67 API calls _doexit 85366->85373 85367->85232 85368->85236 85369->85243 85370->85247 85371->85253 85372->85256 85373->85259 85374->85262 85375->85272 85376->85280 85377->85290 85380 417004 85378->85380 85381 416f70 85380->85381 85382 417022 Sleep 85380->85382 85386 422452 85380->85386 85381->85270 85381->85295 85383 417037 85382->85383 85383->85380 85383->85381 85384->85299 85385->85276 85387 42245e __read 85386->85387 85388 422476 85387->85388 85398 422495 _memset 85387->85398 85399 417f23 67 API calls __getptd_noexit 85388->85399 85390 42247b 85400 417ebb 6 API calls 2 library calls 85390->85400 85392 422507 HeapAlloc 85392->85398 85393 42248b __read 85393->85380 85395 418407 __lock 66 API calls 85395->85398 85398->85392 85398->85393 85398->85395 85401 41a74c 5 API calls 2 library calls 85398->85401 85402 42254e LeaveCriticalSection _doexit 85398->85402 85403 411afc 6 API calls __decode_pointer 85398->85403 85399->85390 85401->85398 85402->85398 85403->85398 85404->85302 85405->85312 85406->85310 85407->85333 85408->85336 85410 41848c 85409->85410 85411 41696e __encode_pointer 6 API calls 85410->85411 85412 4184a4 85410->85412 85411->85410 85412->85341 85457 40eb70 85413->85457 85416->85354 85417->85356 85418->85358 85461 401f80 85419->85461 85421 40d6f1 IsDebuggerPresent 85422 431a9d MessageBoxA 85421->85422 85423 40d6ff 85421->85423 85424 431ab6 85422->85424 85423->85424 85425 40d71f 85423->85425 85563 403e90 75 API calls 3 library calls 85424->85563 85531 40f3b0 85425->85531 85429 40d73a GetFullPathNameW 85561 401440 127 API calls _wcscat 85429->85561 85431 40d77a 85432 40d782 85431->85432 85433 431b09 SetCurrentDirectoryW 85431->85433 85434 40d78b 85432->85434 85564 43604b 6 API calls 85432->85564 85433->85432 85543 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 85434->85543 85437 431b28 85437->85434 85439 431b30 GetModuleFileNameW 85437->85439 85441 431ba4 GetForegroundWindow ShellExecuteW 85439->85441 85442 431b4c 85439->85442 85444 40d7c7 85441->85444 85565 401b70 85442->85565 85443 40d795 85450 40d7a8 85443->85450 85551 40e1e0 85443->85551 85448 40d7d1 SetCurrentDirectoryW 85444->85448 85448->85360 85450->85444 85562 401000 Shell_NotifyIconW _memset 85450->85562 85451 431b66 85572 40d3b0 75 API calls 2 library calls 85451->85572 85454 431b72 GetForegroundWindow ShellExecuteW 85455 431b9f 85454->85455 85455->85444 85456 40eba0 LoadLibraryA GetProcAddress 85456->85353 85458 40d86e 85457->85458 85459 40eb76 LoadLibraryA 85457->85459 85458->85353 85458->85456 85459->85458 85460 40eb87 GetProcAddress 85459->85460 85460->85458 85573 40e680 85461->85573 85465 401fa2 GetModuleFileNameW 85591 40ff90 85465->85591 85467 401fbd 85603 4107b0 85467->85603 85470 401b70 75 API calls 85471 401fe4 85470->85471 85606 4019e0 85471->85606 85473 401ff2 85474 4092c0 VariantClear 85473->85474 85475 402002 85474->85475 85476 401b70 75 API calls 85475->85476 85477 40201c 85476->85477 85478 4019e0 76 API calls 85477->85478 85479 40202c 85478->85479 85480 401b70 75 API calls 85479->85480 85481 40203c 85480->85481 85614 40c3e0 85481->85614 85483 40204d 85484 40c060 75 API calls 85483->85484 85485 402061 85484->85485 85632 401a70 85485->85632 85487 40206e 85639 4115d0 85487->85639 85490 42c174 85492 401a70 75 API calls 85490->85492 85491 402088 85493 4115d0 __wcsicoll 79 API calls 85491->85493 85494 42c189 85492->85494 85495 402093 85493->85495 85497 401a70 75 API calls 85494->85497 85495->85494 85496 40209e 85495->85496 85498 4115d0 __wcsicoll 79 API calls 85496->85498 85499 42c1a7 85497->85499 85500 4020a9 85498->85500 85501 42c1b0 GetModuleFileNameW 85499->85501 85500->85501 85502 4020b4 85500->85502 85504 401a70 75 API calls 85501->85504 85503 4115d0 __wcsicoll 79 API calls 85502->85503 85505 4020bf 85503->85505 85506 42c1e2 85504->85506 85508 42c20a _wcscpy 85505->85508 85512 401a70 75 API calls 85505->85512 85522 402107 85505->85522 85651 40df50 75 API calls 85506->85651 85517 401a70 75 API calls 85508->85517 85509 42c1f1 85513 401a70 75 API calls 85509->85513 85510 42c243 85511 402119 85511->85510 85647 40e7e0 76 API calls 85511->85647 85515 4020e5 _wcscpy 85512->85515 85516 42c201 85513->85516 85520 401a70 75 API calls 85515->85520 85516->85508 85526 402148 85517->85526 85518 402132 85648 40d030 76 API calls 85518->85648 85520->85522 85521 40213e 85523 4092c0 VariantClear 85521->85523 85522->85508 85522->85511 85523->85526 85524 402184 85528 4092c0 VariantClear 85524->85528 85526->85524 85529 401a70 75 API calls 85526->85529 85649 40d030 76 API calls 85526->85649 85650 40e640 76 API calls 85526->85650 85530 402196 ctype 85528->85530 85529->85526 85530->85421 85532 42ccf4 _memset 85531->85532 85533 40f3c9 85531->85533 85535 42cd05 GetOpenFileNameW 85532->85535 86334 40ffb0 76 API calls ctype 85533->86334 85535->85533 85537 40d732 85535->85537 85536 40f3d2 86335 410130 SHGetMalloc 85536->86335 85537->85429 85537->85431 85539 40f3d9 86340 410020 88 API calls __wcsicoll 85539->86340 85541 40f3e7 86341 40f400 85541->86341 85544 42b9d3 85543->85544 85545 41025a LoadImageW RegisterClassExW 85543->85545 86394 443e8f EnumResourceNamesW LoadImageW 85544->86394 86393 4102f0 7 API calls 85545->86393 85548 40d790 85550 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 85548->85550 85549 42b9da 85550->85443 85553 40e207 _memset 85551->85553 85552 40e262 85555 40e2a4 85552->85555 86417 43737d 84 API calls __wcsicoll 85552->86417 85553->85552 85554 42aa14 DestroyIcon 85553->85554 85554->85552 85557 40e2c0 Shell_NotifyIconW 85555->85557 85558 42aa50 Shell_NotifyIconW 85555->85558 86395 401be0 85557->86395 85560 40e2da 85560->85450 85561->85431 85562->85444 85563->85431 85564->85437 85566 401b76 _wcslen 85565->85566 85567 41171a 75 API calls 85566->85567 85570 401bc5 85566->85570 85568 401bad _memcpy_s 85567->85568 85569 41171a 75 API calls 85568->85569 85569->85570 85571 40d3b0 75 API calls 2 library calls 85570->85571 85571->85451 85572->85454 85574 40c060 75 API calls 85573->85574 85575 401f90 85574->85575 85576 402940 85575->85576 85577 40294a __write_nolock 85576->85577 85652 4021e0 85577->85652 85580 402972 85590 4029a4 85580->85590 85664 401cf0 85580->85664 85581 402ae0 75 API calls 85581->85590 85582 402a8c 85583 401b70 75 API calls 85582->85583 85589 402abe 85582->85589 85585 402ab3 85583->85585 85584 401b70 75 API calls 85584->85590 85668 40d970 75 API calls 2 library calls 85585->85668 85586 401cf0 75 API calls 85586->85590 85589->85465 85590->85581 85590->85582 85590->85584 85590->85586 85667 40d970 75 API calls 2 library calls 85590->85667 85670 40f5e0 85591->85670 85594 40ffa6 85594->85467 85596 42b6d8 85597 42b6e6 85596->85597 85726 434fe1 85596->85726 85599 413a88 ___free_lconv_num 67 API calls 85597->85599 85600 42b6f5 85599->85600 85601 434fe1 106 API calls 85600->85601 85602 42b702 85601->85602 85602->85467 85604 41171a 75 API calls 85603->85604 85605 401fd6 85604->85605 85605->85470 85607 401a03 85606->85607 85608 4019e5 85606->85608 85607->85608 85609 401a1a 85607->85609 85610 4019ff 85608->85610 86322 404260 76 API calls 85608->86322 86323 404260 76 API calls 85609->86323 85610->85473 85613 401a26 85613->85473 85615 40c3e4 85614->85615 85616 40c42c 85614->85616 85617 40c3f0 85615->85617 85618 42a475 85615->85618 85619 42a422 85616->85619 85620 40c435 85616->85620 86324 4042f0 75 API calls __cinit 85617->86324 86329 453155 75 API calls 85618->86329 85622 42a427 85619->85622 85623 42a445 85619->85623 85624 40c441 85620->85624 85625 42a455 85620->85625 85631 40c3fb 85622->85631 86326 453155 75 API calls 85622->86326 86327 453155 75 API calls 85623->86327 86325 4042f0 75 API calls __cinit 85624->86325 86328 453155 75 API calls 85625->86328 85631->85483 85633 401a90 85632->85633 85634 401a77 85632->85634 85636 4021e0 75 API calls 85633->85636 85635 401a8d 85634->85635 86330 404080 75 API calls _memcpy_s 85634->86330 85635->85487 85638 401a9c 85636->85638 85638->85487 85640 4115e1 85639->85640 85641 411650 85639->85641 85646 40207d 85640->85646 86331 417f23 67 API calls __getptd_noexit 85640->86331 86333 4114bf 79 API calls 3 library calls 85641->86333 85644 4115ed 86332 417ebb 6 API calls 2 library calls 85644->86332 85646->85490 85646->85491 85647->85518 85648->85521 85649->85526 85650->85526 85651->85509 85653 42a598 85652->85653 85656 4021f1 _wcslen 85652->85656 85654 40c740 75 API calls 85653->85654 85655 42a5a2 85654->85655 85657 402205 85656->85657 85658 402226 85656->85658 85669 404020 75 API calls ctype 85657->85669 85660 401380 75 API calls 85658->85660 85662 40222d 85660->85662 85661 40220c _memcpy_s 85661->85580 85662->85655 85663 41171a 75 API calls 85662->85663 85663->85661 85665 402ae0 75 API calls 85664->85665 85666 401cf7 85665->85666 85666->85580 85667->85590 85668->85589 85669->85661 85671 40f580 77 API calls 85670->85671 85672 40f5f8 _strcat ctype 85671->85672 85730 40f6d0 85672->85730 85677 42b2ee 85759 4151b0 85677->85759 85679 40f679 85679->85677 85680 40f681 85679->85680 85746 414e94 85680->85746 85684 40f68b 85684->85594 85689 452574 85684->85689 85686 42b31d 85765 415484 85686->85765 85688 42b33d 85690 41557c _fseek 105 API calls 85689->85690 85691 4525df 85690->85691 86267 4523ce 85691->86267 85694 4525fc 85694->85596 85695 4151b0 __fread_nolock 81 API calls 85696 45261d 85695->85696 85697 4151b0 __fread_nolock 81 API calls 85696->85697 85698 45262e 85697->85698 85699 4151b0 __fread_nolock 81 API calls 85698->85699 85700 452649 85699->85700 85701 4151b0 __fread_nolock 81 API calls 85700->85701 85702 452666 85701->85702 85703 41557c _fseek 105 API calls 85702->85703 85704 452682 85703->85704 85705 4138ba _malloc 67 API calls 85704->85705 85706 45268e 85705->85706 85707 4138ba _malloc 67 API calls 85706->85707 85708 45269b 85707->85708 85709 4151b0 __fread_nolock 81 API calls 85708->85709 85710 4526ac 85709->85710 85711 44afdc GetSystemTimeAsFileTime 85710->85711 85712 4526bf 85711->85712 85713 4526d5 85712->85713 85714 4526fd 85712->85714 85717 413a88 ___free_lconv_num 67 API calls 85713->85717 85715 452704 85714->85715 85716 45275b 85714->85716 86273 44b195 85715->86273 85719 413a88 ___free_lconv_num 67 API calls 85716->85719 85720 4526df 85717->85720 85724 452759 85719->85724 85722 413a88 ___free_lconv_num 67 API calls 85720->85722 85721 452753 85723 413a88 ___free_lconv_num 67 API calls 85721->85723 85725 4526e8 85722->85725 85723->85724 85724->85596 85725->85596 85727 434ff1 85726->85727 85728 434feb 85726->85728 85727->85597 85729 414e94 __fcloseall 106 API calls 85728->85729 85729->85727 85731 40f6dd _strlen 85730->85731 85778 40f790 85731->85778 85734 414e06 85798 414d40 85734->85798 85736 40f666 85736->85677 85737 40f450 85736->85737 85740 40f45a _strcat _memcpy_s __write_nolock 85737->85740 85738 4151b0 __fread_nolock 81 API calls 85738->85740 85740->85738 85741 42936d 85740->85741 85745 40f531 85740->85745 85881 41557c 85740->85881 85742 41557c _fseek 105 API calls 85741->85742 85743 429394 85742->85743 85744 4151b0 __fread_nolock 81 API calls 85743->85744 85744->85745 85745->85679 85747 414ea0 __read 85746->85747 85748 414ed1 85747->85748 85749 414eb4 85747->85749 85751 415965 __lock_file 68 API calls 85748->85751 85755 414ec9 __read 85748->85755 86020 417f23 67 API calls __getptd_noexit 85749->86020 85753 414ee9 85751->85753 85752 414eb9 86021 417ebb 6 API calls 2 library calls 85752->86021 86004 414e1d 85753->86004 85755->85684 86089 41511a 85759->86089 85761 4151c8 85762 44afdc 85761->85762 86260 4431e0 85762->86260 85764 44affd 85764->85686 85766 415490 __read 85765->85766 85767 4154bb 85766->85767 85768 41549e 85766->85768 85769 415965 __lock_file 68 API calls 85767->85769 86264 417f23 67 API calls __getptd_noexit 85768->86264 85771 4154c3 85769->85771 85774 4152e7 __ftell_nolock 71 API calls 85771->85774 85772 4154a3 86265 417ebb 6 API calls 2 library calls 85772->86265 85775 4154cf 85774->85775 86266 4154e8 LeaveCriticalSection LeaveCriticalSection __wfsopen 85775->86266 85777 4154b3 __read 85777->85688 85780 40f7ae _memset 85778->85780 85779 42a349 85780->85779 85782 40f628 85780->85782 85783 415258 85780->85783 85782->85734 85784 415285 85783->85784 85785 415268 85783->85785 85784->85785 85786 41528c 85784->85786 85794 417f23 67 API calls __getptd_noexit 85785->85794 85796 41c551 103 API calls 13 library calls 85786->85796 85789 41526d 85795 417ebb 6 API calls 2 library calls 85789->85795 85790 4152b2 85792 41527d 85790->85792 85797 4191c9 101 API calls 6 library calls 85790->85797 85792->85780 85794->85789 85796->85790 85797->85792 85800 414d4c __read 85798->85800 85799 414d5f 85850 417f23 67 API calls __getptd_noexit 85799->85850 85800->85799 85802 414d95 85800->85802 85817 41e28c 85802->85817 85803 414d64 85851 417ebb 6 API calls 2 library calls 85803->85851 85806 414d9a 85808 414da1 85806->85808 85809 414dae 85806->85809 85807 414d74 @_EH4_CallFilterFunc@8 __read 85807->85736 85852 417f23 67 API calls __getptd_noexit 85808->85852 85811 414dd6 85809->85811 85812 414db6 85809->85812 85835 41dfd8 85811->85835 85853 417f23 67 API calls __getptd_noexit 85812->85853 85818 41e298 __read 85817->85818 85819 418407 __lock 67 API calls 85818->85819 85832 41e2a6 85819->85832 85820 41e31b 85855 41e3bb 85820->85855 85821 41e322 85823 416fb6 __malloc_crt 67 API calls 85821->85823 85825 41e32c 85823->85825 85824 41e3b0 __read 85824->85806 85825->85820 85860 4189e6 InitializeCriticalSectionAndSpinCount __read 85825->85860 85826 418344 __mtinitlocknum 67 API calls 85826->85832 85829 41e351 85830 41e35c 85829->85830 85831 41e36f EnterCriticalSection 85829->85831 85833 413a88 ___free_lconv_num 67 API calls 85830->85833 85831->85820 85832->85820 85832->85821 85832->85826 85858 4159a6 68 API calls __lock 85832->85858 85859 415a14 LeaveCriticalSection LeaveCriticalSection _doexit 85832->85859 85833->85820 85843 41dffb __wopenfile 85835->85843 85836 41e015 85865 417f23 67 API calls __getptd_noexit 85836->85865 85838 41e01a 85866 417ebb 6 API calls 2 library calls 85838->85866 85839 41e247 85862 425db0 85839->85862 85843->85836 85849 41e1e9 85843->85849 85867 4136bc 79 API calls 2 library calls 85843->85867 85845 41e1e2 85845->85849 85868 4136bc 79 API calls 2 library calls 85845->85868 85847 41e201 85847->85849 85869 4136bc 79 API calls 2 library calls 85847->85869 85849->85836 85849->85839 85850->85803 85852->85807 85853->85807 85854 414dfc LeaveCriticalSection LeaveCriticalSection __wfsopen 85854->85807 85861 41832d LeaveCriticalSection 85855->85861 85857 41e3c2 85857->85824 85858->85832 85859->85832 85860->85829 85861->85857 85870 425ce4 85862->85870 85864 414de1 85864->85854 85865->85838 85867->85845 85868->85847 85869->85849 85871 425cf0 __read 85870->85871 85872 425d03 85871->85872 85875 425d41 85871->85875 85873 417f23 ___wstrgtold12_l 67 API calls 85872->85873 85874 425d08 85873->85874 85876 417ebb ___wstrgtold12_l 6 API calls 85874->85876 85877 4255c4 __tsopen_nolock 132 API calls 85875->85877 85880 425d17 __read 85876->85880 85878 425d5b 85877->85878 85879 425d82 __sopen_helper LeaveCriticalSection 85878->85879 85879->85880 85880->85864 85885 415588 __read 85881->85885 85882 415596 85912 417f23 67 API calls __getptd_noexit 85882->85912 85884 4155c4 85894 415965 85884->85894 85885->85882 85885->85884 85887 41559b 85913 417ebb 6 API calls 2 library calls 85887->85913 85893 4155ab __read 85893->85740 85895 415977 85894->85895 85896 415999 EnterCriticalSection 85894->85896 85895->85896 85897 41597f 85895->85897 85899 4155cc 85896->85899 85898 418407 __lock 67 API calls 85897->85898 85898->85899 85900 4154f2 85899->85900 85901 415512 85900->85901 85902 415502 85900->85902 85904 415524 85901->85904 85915 4152e7 85901->85915 85969 417f23 67 API calls __getptd_noexit 85902->85969 85932 41486c 85904->85932 85911 415507 85914 4155f7 LeaveCriticalSection LeaveCriticalSection __wfsopen 85911->85914 85912->85887 85914->85893 85916 41531a 85915->85916 85917 4152fa 85915->85917 85919 41453a __fileno 67 API calls 85916->85919 85970 417f23 67 API calls __getptd_noexit 85917->85970 85920 415320 85919->85920 85923 41efd4 __locking 71 API calls 85920->85923 85921 4152ff 85971 417ebb 6 API calls 2 library calls 85921->85971 85924 415335 85923->85924 85925 4153a9 85924->85925 85927 415364 85924->85927 85931 41530f 85924->85931 85972 417f23 67 API calls __getptd_noexit 85925->85972 85928 41efd4 __locking 71 API calls 85927->85928 85927->85931 85929 415404 85928->85929 85930 41efd4 __locking 71 API calls 85929->85930 85929->85931 85930->85931 85931->85904 85933 414885 85932->85933 85937 4148a7 85932->85937 85934 41453a __fileno 67 API calls 85933->85934 85933->85937 85935 4148a0 85934->85935 85973 41c3cf 101 API calls 5 library calls 85935->85973 85938 41453a 85937->85938 85939 41455e 85938->85939 85940 414549 85938->85940 85944 41efd4 85939->85944 85974 417f23 67 API calls __getptd_noexit 85940->85974 85942 41454e 85975 417ebb 6 API calls 2 library calls 85942->85975 85945 41efe0 __read 85944->85945 85946 41efe8 85945->85946 85948 41f003 85945->85948 85996 417f36 67 API calls __getptd_noexit 85946->85996 85947 41f011 85998 417f36 67 API calls __getptd_noexit 85947->85998 85948->85947 85954 41f052 85948->85954 85950 41efed 85997 417f23 67 API calls __getptd_noexit 85950->85997 85953 41f016 85999 417f23 67 API calls __getptd_noexit 85953->85999 85976 41ba3b 85954->85976 85957 41f058 85959 41f065 85957->85959 85960 41f07b 85957->85960 85958 41f01d 86000 417ebb 6 API calls 2 library calls 85958->86000 85986 41ef5f 85959->85986 86001 417f23 67 API calls __getptd_noexit 85960->86001 85964 41eff5 __read 85964->85911 85965 41f073 86003 41f0a6 LeaveCriticalSection __unlock_fhandle 85965->86003 85966 41f080 86002 417f36 67 API calls __getptd_noexit 85966->86002 85969->85911 85970->85921 85972->85931 85973->85937 85974->85942 85977 41ba47 __read 85976->85977 85978 41baa2 85977->85978 85979 418407 __lock 67 API calls 85977->85979 85980 41bac4 __read 85978->85980 85981 41baa7 EnterCriticalSection 85978->85981 85982 41ba73 85979->85982 85980->85957 85981->85980 85983 41ba8a 85982->85983 85984 4189e6 __alloc_osfhnd InitializeCriticalSectionAndSpinCount 85982->85984 85985 41bad2 ___lock_fhandle LeaveCriticalSection 85983->85985 85984->85983 85985->85978 85987 41b9c4 __close_nolock 67 API calls 85986->85987 85988 41ef6e 85987->85988 85989 41ef84 SetFilePointer 85988->85989 85990 41ef74 85988->85990 85992 41efa3 85989->85992 85993 41ef9b GetLastError 85989->85993 85991 417f23 ___wstrgtold12_l 67 API calls 85990->85991 85994 41ef79 85991->85994 85992->85994 85995 417f49 __dosmaperr 67 API calls 85992->85995 85993->85992 85994->85965 85995->85994 85996->85950 85997->85964 85998->85953 85999->85958 86001->85966 86002->85965 86003->85964 86005 414e31 86004->86005 86006 414e4d 86004->86006 86050 417f23 67 API calls __getptd_noexit 86005->86050 86009 41486c __flush 101 API calls 86006->86009 86018 414e46 86006->86018 86008 414e36 86051 417ebb 6 API calls 2 library calls 86008->86051 86011 414e59 86009->86011 86023 41e680 86011->86023 86014 41453a __fileno 67 API calls 86015 414e67 86014->86015 86027 41e5b3 86015->86027 86017 414e6d 86017->86018 86019 413a88 ___free_lconv_num 67 API calls 86017->86019 86022 414f08 LeaveCriticalSection LeaveCriticalSection __wfsopen 86018->86022 86019->86018 86020->85752 86022->85755 86024 41e690 86023->86024 86025 414e61 86023->86025 86024->86025 86026 413a88 ___free_lconv_num 67 API calls 86024->86026 86025->86014 86026->86025 86028 41e5bf __read 86027->86028 86029 41e5e2 86028->86029 86030 41e5c7 86028->86030 86031 41e5f0 86029->86031 86036 41e631 86029->86036 86067 417f36 67 API calls __getptd_noexit 86030->86067 86069 417f36 67 API calls __getptd_noexit 86031->86069 86034 41e5cc 86068 417f23 67 API calls __getptd_noexit 86034->86068 86035 41e5f5 86070 417f23 67 API calls __getptd_noexit 86035->86070 86039 41ba3b ___lock_fhandle 68 API calls 86036->86039 86041 41e637 86039->86041 86040 41e5fc 86071 417ebb 6 API calls 2 library calls 86040->86071 86043 41e652 86041->86043 86044 41e644 86041->86044 86072 417f23 67 API calls __getptd_noexit 86043->86072 86052 41e517 86044->86052 86046 41e5d4 __read 86046->86017 86048 41e64c 86073 41e676 LeaveCriticalSection __unlock_fhandle 86048->86073 86050->86008 86074 41b9c4 86052->86074 86054 41e57d 86087 41b93e 68 API calls 2 library calls 86054->86087 86056 41e527 86056->86054 86057 41e55b 86056->86057 86059 41b9c4 __close_nolock 67 API calls 86056->86059 86057->86054 86060 41b9c4 __close_nolock 67 API calls 86057->86060 86058 41e585 86061 41e5a7 86058->86061 86088 417f49 67 API calls 3 library calls 86058->86088 86062 41e552 86059->86062 86063 41e567 CloseHandle 86060->86063 86061->86048 86065 41b9c4 __close_nolock 67 API calls 86062->86065 86063->86054 86066 41e573 GetLastError 86063->86066 86065->86057 86066->86054 86067->86034 86068->86046 86069->86035 86070->86040 86072->86048 86073->86046 86075 41b9d1 86074->86075 86076 41b9e9 86074->86076 86077 417f36 __read 67 API calls 86075->86077 86078 417f36 __read 67 API calls 86076->86078 86084 41ba2e 86076->86084 86079 41b9d6 86077->86079 86081 41ba17 86078->86081 86080 417f23 ___wstrgtold12_l 67 API calls 86079->86080 86082 41b9de 86080->86082 86083 417f23 ___wstrgtold12_l 67 API calls 86081->86083 86082->86056 86085 41ba1e 86083->86085 86084->86056 86086 417ebb ___wstrgtold12_l 6 API calls 86085->86086 86086->86084 86087->86058 86088->86061 86090 415126 __read 86089->86090 86091 41513a _memset 86090->86091 86092 41516f 86090->86092 86093 415164 __read 86090->86093 86118 417f23 67 API calls __getptd_noexit 86091->86118 86094 415965 __lock_file 68 API calls 86092->86094 86093->85761 86095 415177 86094->86095 86102 414f10 86095->86102 86098 415154 86119 417ebb 6 API calls 2 library calls 86098->86119 86105 414f2e _memset 86102->86105 86109 414f4c 86102->86109 86103 414f37 86171 417f23 67 API calls __getptd_noexit 86103->86171 86105->86103 86105->86109 86115 414f8b 86105->86115 86106 414f3c 86172 417ebb 6 API calls 2 library calls 86106->86172 86120 4151a6 LeaveCriticalSection LeaveCriticalSection __wfsopen 86109->86120 86110 4150d5 _memset 86175 417f23 67 API calls __getptd_noexit 86110->86175 86111 4150a9 _memset 86174 417f23 67 API calls __getptd_noexit 86111->86174 86112 41453a __fileno 67 API calls 86112->86115 86115->86109 86115->86110 86115->86111 86115->86112 86121 41ed9e 86115->86121 86151 41e6b1 86115->86151 86173 41ee9b 67 API calls 3 library calls 86115->86173 86118->86098 86120->86093 86122 41edaa __read 86121->86122 86123 41edb2 86122->86123 86124 41edcd 86122->86124 86245 417f36 67 API calls __getptd_noexit 86123->86245 86126 41eddb 86124->86126 86130 41ee1c 86124->86130 86247 417f36 67 API calls __getptd_noexit 86126->86247 86128 41edb7 86246 417f23 67 API calls __getptd_noexit 86128->86246 86129 41ede0 86248 417f23 67 API calls __getptd_noexit 86129->86248 86133 41ee29 86130->86133 86134 41ee3d 86130->86134 86250 417f36 67 API calls __getptd_noexit 86133->86250 86137 41ba3b ___lock_fhandle 68 API calls 86134->86137 86135 41ede7 86249 417ebb 6 API calls 2 library calls 86135->86249 86138 41ee43 86137->86138 86140 41ee50 86138->86140 86141 41ee66 86138->86141 86139 41ee2e 86251 417f23 67 API calls __getptd_noexit 86139->86251 86176 41e7dc 86140->86176 86252 417f23 67 API calls __getptd_noexit 86141->86252 86144 41edbf __read 86144->86115 86147 41ee5e 86254 41ee91 LeaveCriticalSection __unlock_fhandle 86147->86254 86148 41ee6b 86253 417f36 67 API calls __getptd_noexit 86148->86253 86152 41e6c1 86151->86152 86155 41e6de 86151->86155 86258 417f23 67 API calls __getptd_noexit 86152->86258 86154 41e6c6 86259 417ebb 6 API calls 2 library calls 86154->86259 86157 41e713 86155->86157 86163 41e6d6 86155->86163 86255 423600 86155->86255 86159 41453a __fileno 67 API calls 86157->86159 86160 41e727 86159->86160 86161 41ed9e __read 79 API calls 86160->86161 86162 41e72e 86161->86162 86162->86163 86164 41453a __fileno 67 API calls 86162->86164 86163->86115 86165 41e751 86164->86165 86165->86163 86166 41453a __fileno 67 API calls 86165->86166 86167 41e75d 86166->86167 86167->86163 86168 41453a __fileno 67 API calls 86167->86168 86169 41e769 86168->86169 86170 41453a __fileno 67 API calls 86169->86170 86170->86163 86171->86106 86173->86115 86174->86106 86175->86106 86177 41e813 86176->86177 86178 41e7f8 86176->86178 86179 41e822 86177->86179 86182 41e849 86177->86182 86180 417f36 __read 67 API calls 86178->86180 86183 417f36 __read 67 API calls 86179->86183 86181 41e7fd 86180->86181 86184 417f23 ___wstrgtold12_l 67 API calls 86181->86184 86186 41e868 86182->86186 86197 41e87c 86182->86197 86185 41e827 86183->86185 86198 41e805 86184->86198 86188 417f23 ___wstrgtold12_l 67 API calls 86185->86188 86189 417f36 __read 67 API calls 86186->86189 86187 41e8d4 86191 417f36 __read 67 API calls 86187->86191 86190 41e82e 86188->86190 86192 41e86d 86189->86192 86194 417ebb ___wstrgtold12_l 6 API calls 86190->86194 86195 41e8d9 86191->86195 86193 417f23 ___wstrgtold12_l 67 API calls 86192->86193 86196 41e874 86193->86196 86194->86198 86199 417f23 ___wstrgtold12_l 67 API calls 86195->86199 86201 417ebb ___wstrgtold12_l 6 API calls 86196->86201 86197->86187 86197->86198 86200 41e8b0 86197->86200 86202 41e8f5 86197->86202 86198->86147 86199->86196 86200->86187 86205 41e8bb ReadFile 86200->86205 86201->86198 86204 416fb6 __malloc_crt 67 API calls 86202->86204 86206 41e90b 86204->86206 86207 41ed62 GetLastError 86205->86207 86208 41e9e7 86205->86208 86211 41e931 86206->86211 86212 41e913 86206->86212 86209 41ebe8 86207->86209 86210 41ed6f 86207->86210 86208->86207 86216 41e9fb 86208->86216 86220 417f49 __dosmaperr 67 API calls 86209->86220 86224 41eb6d 86209->86224 86214 417f23 ___wstrgtold12_l 67 API calls 86210->86214 86213 423462 __lseeki64_nolock 69 API calls 86211->86213 86215 417f23 ___wstrgtold12_l 67 API calls 86212->86215 86217 41e93d 86213->86217 86218 41ed74 86214->86218 86219 41e918 86215->86219 86216->86224 86225 41ea17 86216->86225 86228 41ec2d 86216->86228 86217->86205 86221 417f36 __read 67 API calls 86218->86221 86222 417f36 __read 67 API calls 86219->86222 86220->86224 86221->86224 86222->86198 86223 413a88 ___free_lconv_num 67 API calls 86223->86198 86224->86198 86224->86223 86226 41ea7d ReadFile 86225->86226 86233 41eafa 86225->86233 86231 41ea9b GetLastError 86226->86231 86236 41eaa5 86226->86236 86227 41eca5 ReadFile 86229 41ecc4 GetLastError 86227->86229 86237 41ecce 86227->86237 86228->86224 86228->86227 86229->86228 86229->86237 86230 41ebbe MultiByteToWideChar 86230->86224 86232 41ebe2 GetLastError 86230->86232 86231->86225 86231->86236 86232->86209 86233->86224 86234 41eb75 86233->86234 86235 41eb68 86233->86235 86239 41eb32 86233->86239 86234->86239 86240 41ebac 86234->86240 86238 417f23 ___wstrgtold12_l 67 API calls 86235->86238 86236->86225 86241 423462 __lseeki64_nolock 69 API calls 86236->86241 86237->86228 86242 423462 __lseeki64_nolock 69 API calls 86237->86242 86238->86224 86239->86230 86243 423462 __lseeki64_nolock 69 API calls 86240->86243 86241->86236 86242->86237 86244 41ebbb 86243->86244 86244->86230 86245->86128 86246->86144 86247->86129 86248->86135 86250->86139 86251->86135 86252->86148 86253->86147 86254->86144 86256 416fb6 __malloc_crt 67 API calls 86255->86256 86257 423615 86256->86257 86257->86157 86258->86154 86263 414cef GetSystemTimeAsFileTime __aulldiv 86260->86263 86262 4431ef 86262->85764 86263->86262 86264->85772 86266->85777 86271 4523e1 _wcscpy 86267->86271 86268 4151b0 81 API calls __fread_nolock 86268->86271 86269 44afdc GetSystemTimeAsFileTime 86269->86271 86270 452553 86270->85694 86270->85695 86271->86268 86271->86269 86271->86270 86272 41557c 105 API calls _fseek 86271->86272 86272->86271 86274 44b1b4 86273->86274 86275 44b1a6 86273->86275 86277 44b1ca 86274->86277 86278 414e06 138 API calls 86274->86278 86279 44b1c2 86274->86279 86276 414e06 138 API calls 86275->86276 86276->86274 86308 4352d1 81 API calls 2 library calls 86277->86308 86281 44b2c1 86278->86281 86279->85721 86281->86277 86283 44b2cf 86281->86283 86282 44b20d 86284 44b211 86282->86284 86285 44b23b 86282->86285 86286 44b2dc 86283->86286 86288 414e94 __fcloseall 106 API calls 86283->86288 86287 44b21e 86284->86287 86290 414e94 __fcloseall 106 API calls 86284->86290 86309 43526e 86285->86309 86286->85721 86292 414e94 __fcloseall 106 API calls 86287->86292 86295 44b22e 86287->86295 86288->86286 86290->86287 86291 44b242 86293 44b270 86291->86293 86296 44b248 86291->86296 86292->86295 86319 44b0af 111 API calls 86293->86319 86295->85721 86297 44b255 86296->86297 86298 414e94 __fcloseall 106 API calls 86296->86298 86299 44b265 86297->86299 86301 414e94 __fcloseall 106 API calls 86297->86301 86298->86297 86299->85721 86300 44b276 86320 43522c 67 API calls ___free_lconv_num 86300->86320 86301->86299 86303 44b27c 86304 44b289 86303->86304 86306 414e94 __fcloseall 106 API calls 86303->86306 86305 44b299 86304->86305 86307 414e94 __fcloseall 106 API calls 86304->86307 86305->85721 86306->86304 86307->86305 86308->86282 86310 4138ba _malloc 67 API calls 86309->86310 86311 43527d 86310->86311 86312 4138ba _malloc 67 API calls 86311->86312 86313 43528d 86312->86313 86314 4138ba _malloc 67 API calls 86313->86314 86315 43529d 86314->86315 86317 4352bc 86315->86317 86321 43522c 67 API calls ___free_lconv_num 86315->86321 86317->86291 86318 4352c8 86318->86291 86319->86300 86320->86303 86321->86318 86322->85610 86323->85613 86324->85631 86325->85631 86326->85631 86327->85625 86328->85631 86329->85631 86330->85635 86331->85644 86333->85646 86334->85536 86336 410148 SHGetDesktopFolder 86335->86336 86339 4101a3 _wcscpy 86335->86339 86337 41015a _wcscpy 86336->86337 86336->86339 86338 41018a SHGetPathFromIDListW 86337->86338 86337->86339 86338->86339 86339->85539 86340->85541 86342 40f5e0 152 API calls 86341->86342 86343 40f417 86342->86343 86344 42ca37 86343->86344 86346 40f42c 86343->86346 86347 42ca1f 86343->86347 86345 452574 140 API calls 86344->86345 86349 42ca50 86345->86349 86389 4037e0 139 API calls 7 library calls 86346->86389 86390 43717f 110 API calls _printf 86347->86390 86352 42ca76 86349->86352 86353 42ca54 86349->86353 86351 42ca2d 86351->86344 86356 41171a 75 API calls 86352->86356 86355 434fe1 106 API calls 86353->86355 86354 40f446 86354->85537 86357 42ca5e 86355->86357 86371 42cacc ctype 86356->86371 86391 43717f 110 API calls _printf 86357->86391 86359 42ccc3 86361 413a88 ___free_lconv_num 67 API calls 86359->86361 86360 42ca6c 86360->86352 86362 42cccd 86361->86362 86363 434fe1 106 API calls 86362->86363 86364 42ccda 86363->86364 86368 401b70 75 API calls 86368->86371 86371->86359 86371->86368 86372 445051 86371->86372 86375 44b408 86371->86375 86382 402cc0 75 API calls 2 library calls 86371->86382 86383 4026a0 86371->86383 86392 44c80c 87 API calls 3 library calls 86371->86392 86373 41171a 75 API calls 86372->86373 86374 445080 _memcpy_s 86373->86374 86374->86371 86374->86374 86376 44b414 86375->86376 86377 41171a 75 API calls 86376->86377 86378 44b42b 86377->86378 86379 44b449 86378->86379 86380 401b70 75 API calls 86378->86380 86379->86371 86381 44b43f 86380->86381 86381->86371 86382->86371 86384 4026af 86383->86384 86387 40276b 86383->86387 86385 41171a 75 API calls 86384->86385 86384->86387 86388 4026ee ctype 86384->86388 86385->86388 86386 41171a 75 API calls 86386->86388 86387->86371 86388->86386 86388->86387 86389->86354 86390->86351 86391->86360 86392->86371 86393->85548 86394->85549 86396 401bfb 86395->86396 86416 401cde 86395->86416 86418 4013a0 86396->86418 86399 42a9a0 LoadStringW 86402 42a9bb 86399->86402 86400 401c18 86401 4021e0 75 API calls 86400->86401 86403 401c2d 86401->86403 86424 40df50 75 API calls 86402->86424 86405 401c3a 86403->86405 86406 42a9cd 86403->86406 86405->86402 86407 401c44 86405->86407 86425 40d3b0 75 API calls 2 library calls 86406->86425 86423 40d3b0 75 API calls 2 library calls 86407->86423 86410 42a9dc 86411 401c53 _memset _wcscpy _wcsncpy 86410->86411 86412 42a9f0 86410->86412 86415 401cc2 Shell_NotifyIconW 86411->86415 86426 40d3b0 75 API calls 2 library calls 86412->86426 86414 42a9fe 86415->86416 86416->85560 86417->85555 86419 41171a 75 API calls 86418->86419 86420 4013c4 86419->86420 86421 401380 75 API calls 86420->86421 86422 4013d3 86421->86422 86422->86399 86422->86400 86423->86411 86424->86411 86425->86410 86426->86414 86427 444343 86430 444326 86427->86430 86429 44434e WriteFile 86431 444340 86430->86431 86432 4442c7 86430->86432 86431->86429 86437 40e190 SetFilePointerEx 86432->86437 86434 4442e0 SetFilePointerEx 86438 40e190 SetFilePointerEx 86434->86438 86436 4442ff 86436->86429 86437->86434 86438->86436 86439 46d22f 86442 46d098 86439->86442 86441 46d241 86443 46d0b5 86442->86443 86444 46d115 86443->86444 86445 46d0b9 86443->86445 86489 45c216 78 API calls 86444->86489 86446 41171a 75 API calls 86445->86446 86448 46d0c0 86446->86448 86450 46d0cc 86448->86450 86486 40d940 76 API calls 86448->86486 86449 46d126 86451 46d0f8 86449->86451 86457 46d142 86449->86457 86454 453063 111 API calls 86450->86454 86452 4092c0 VariantClear 86451->86452 86455 46d0fd 86452->86455 86456 46d0dd 86454->86456 86455->86441 86487 40dfa0 83 API calls 86456->86487 86458 46d1c8 86457->86458 86460 46d158 86457->86460 86494 4676a3 78 API calls 86458->86494 86463 453063 111 API calls 86460->86463 86461 46d0ea 86461->86457 86464 46d0ee 86461->86464 86473 46d15e 86463->86473 86464->86451 86488 44ade5 CloseHandle ctype 86464->86488 86465 46d1ce 86495 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 86465->86495 86466 46d18d 86490 467fce 82 API calls 86466->86490 86469 46d196 86472 4013a0 75 API calls 86469->86472 86471 46d1e7 86475 4092c0 VariantClear 86471->86475 86484 46d194 86471->86484 86474 46d1a2 86472->86474 86473->86466 86473->86469 86491 40df50 75 API calls 86474->86491 86475->86484 86477 46d1ac 86492 40d3b0 75 API calls 2 library calls 86477->86492 86479 46d224 86479->86441 86480 46d1b8 86493 467fce 82 API calls 86480->86493 86481 40d900 CloseHandle 86483 46d216 86481->86483 86496 44ade5 CloseHandle ctype 86483->86496 86484->86479 86484->86481 86486->86450 86487->86461 86488->86451 86489->86449 86490->86484 86491->86477 86492->86480 86493->86484 86494->86465 86495->86471 86496->86479 86497 42919b 86502 40ef10 86497->86502 86500 411421 __cinit 74 API calls 86501 4291aa 86500->86501 86503 41171a 75 API calls 86502->86503 86504 40ef17 86503->86504 86505 42ad48 86504->86505 86510 40ef40 74 API calls __cinit 86504->86510 86507 40ef2a 86511 40e470 86507->86511 86510->86507 86512 40c060 75 API calls 86511->86512 86513 40e483 GetVersionExW 86512->86513 86514 4021e0 75 API calls 86513->86514 86515 40e4bb 86514->86515 86537 40e600 86515->86537 86521 42accc 86523 42ad28 GetSystemInfo 86521->86523 86527 42ad38 GetSystemInfo 86523->86527 86524 40e557 GetCurrentProcess 86557 40ee30 LoadLibraryA GetProcAddress 86524->86557 86525 40e56c 86525->86527 86550 40eee0 86525->86550 86530 40e5c9 86554 40eea0 86530->86554 86533 40e5e0 86535 40e5f1 FreeLibrary 86533->86535 86536 40e5f4 86533->86536 86534 40e5dd FreeLibrary 86534->86533 86535->86536 86536->86500 86538 40e60b 86537->86538 86539 40c740 75 API calls 86538->86539 86540 40e4c2 86539->86540 86541 40e620 86540->86541 86542 40e62a 86541->86542 86543 42ac93 86542->86543 86544 40c740 75 API calls 86542->86544 86545 40e4ce 86544->86545 86545->86521 86546 40ee70 86545->86546 86547 40e551 86546->86547 86548 40ee76 LoadLibraryA 86546->86548 86547->86524 86547->86525 86548->86547 86549 40ee87 GetProcAddress 86548->86549 86549->86547 86551 40e5bf 86550->86551 86552 40eee6 LoadLibraryA 86550->86552 86551->86523 86551->86530 86552->86551 86553 40eef7 GetProcAddress 86552->86553 86553->86551 86558 40eec0 LoadLibraryA GetProcAddress 86554->86558 86556 40e5d3 GetNativeSystemInfo 86556->86533 86556->86534 86557->86525 86558->86556 86559 3eeefd0 86573 3eecc20 86559->86573 86561 3eef09c 86576 3eeeec0 86561->86576 86563 3eef0c5 CreateFileW 86565 3eef114 86563->86565 86566 3eef119 86563->86566 86566->86565 86567 3eef130 VirtualAlloc 86566->86567 86567->86565 86568 3eef14e ReadFile 86567->86568 86568->86565 86569 3eef169 86568->86569 86570 3eedec0 13 API calls 86569->86570 86571 3eef19c 86570->86571 86572 3eef1bf ExitProcess 86571->86572 86572->86565 86579 3ef00c0 GetPEB 86573->86579 86575 3eed2ab 86575->86561 86577 3eeeec9 Sleep 86576->86577 86578 3eeeed7 86577->86578 86580 3ef00ea 86579->86580 86580->86575 86581 40116e 86582 401119 DefWindowProcW 86581->86582

    Control-flow Graph

    APIs
    • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
      • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
      • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 00402078
      • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 0040208E
      • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020A4
      • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020BA
      • Part of subcall function 00401F80: _wcscpy.LIBCMT ref: 004020EF
    • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
    • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
      • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
    • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,00000004), ref: 0040D7D6
    • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
    • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,00000004), ref: 00431B0E
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,00000004), ref: 00431B3F
    • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
    • ShellExecuteW.SHELL32(00000000), ref: 00431B92
      • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
      • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
      • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
      • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
      • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
      • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
      • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
      • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
      • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
      • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
      • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
      • Part of subcall function 0040E1E0: _memset.LIBCMT ref: 0040E202
      • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memset_wcscpy
    • String ID: @GH$@GH$C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
    • API String ID: 2493088469-743509787
    • Opcode ID: ba2e87c3f8820592b330de56266d8528cb530a4dab1fa245838381ec475db17a
    • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
    • Opcode Fuzzy Hash: ba2e87c3f8820592b330de56266d8528cb530a4dab1fa245838381ec475db17a
    • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 138 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 147 40e506-40e509 138->147 148 42accc-42acd1 138->148 151 40e540-40e555 call 40ee70 147->151 152 40e50b-40e51c 147->152 149 42acd3-42acdb 148->149 150 42acdd-42ace0 148->150 154 42ad12-42ad20 149->154 155 42ace2-42aceb 150->155 156 42aced-42acf0 150->156 165 40e557-40e573 GetCurrentProcess call 40ee30 151->165 166 40e579-40e5a8 151->166 157 40e522-40e525 152->157 158 42ac9b-42aca7 152->158 164 42ad28-42ad2d GetSystemInfo 154->164 155->154 156->154 162 42acf2-42ad06 156->162 157->151 163 40e527-40e537 157->163 160 42acb2-42acba 158->160 161 42aca9-42acad 158->161 160->151 161->151 167 42ad08-42ad0c 162->167 168 42ad0e 162->168 169 42acbf-42acc7 163->169 170 40e53d 163->170 172 42ad38-42ad3d GetSystemInfo 164->172 165->166 179 40e575 165->179 166->172 173 40e5ae-40e5c3 call 40eee0 166->173 167->154 168->154 169->151 170->151 173->164 178 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 173->178 182 40e5e0-40e5ef 178->182 183 40e5dd-40e5de FreeLibrary 178->183 179->166 184 40e5f1-40e5f2 FreeLibrary 182->184 185 40e5f4-40e5ff 182->185 183->182 184->185
    APIs
    • GetVersionExW.KERNEL32 ref: 0040E495
      • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
    • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
    • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
    • FreeLibrary.KERNEL32(?), ref: 0040E5DE
    • FreeLibrary.KERNEL32(?), ref: 0040E5F2
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_wcslen
    • String ID: pMH
    • API String ID: 2923339712-2522892712
    • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
    • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
    • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
    • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
    APIs
    • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
    • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: IsThemeActive$uxtheme.dll
    • API String ID: 2574300362-3542929980
    • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
    • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
    • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
    • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28

    Control-flow Graph

    APIs
      • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
    • __wsplitpath.LIBCMT ref: 00410C61
      • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
    • _wcsncat.LIBCMT ref: 00410C78
    • __wmakepath.LIBCMT ref: 00410C94
      • Part of subcall function 00413E3C: __wmakepath_s.LIBCMT ref: 00413E52
      • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
      • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
      • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
    • _wcscpy.LIBCMT ref: 00410CCC
    • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
    • RegQueryValueExW.ADVAPI32 ref: 00429BE4
    • _wcscat.LIBCMT ref: 00429C43
    • _wcslen.LIBCMT ref: 00429C55
    • _wcslen.LIBCMT ref: 00429C66
    • _wcscat.LIBCMT ref: 00429C80
    • _wcsncpy.LIBCMT ref: 00429CC0
    • RegCloseKey.ADVAPI32(?), ref: 00429CDE
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcscat_wcslen$CloseException@8FileModuleNameOpenQueryThrowValue__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpystd::bad_alloc::bad_allocstd::bad_exception::bad_exception
    • String ID: Include$Software\AutoIt v3\AutoIt$\
    • API String ID: 1004883554-2276155026
    • Opcode ID: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
    • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
    • Opcode Fuzzy Hash: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
    • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A

    Control-flow Graph

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __fread_nolock$_fseek_wcscpy
    • String ID: FILE
    • API String ID: 3888824918-3121273764
    • Opcode ID: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
    • Instruction ID: c0f9aeb359a44d31a21a8716142a7f32772eb03c7b5129f1ec28ea3a2d041f76
    • Opcode Fuzzy Hash: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
    • Instruction Fuzzy Hash: D541EFB1504300BBD310EB55CC81FEB73A9AFC8718F54491EFA8457181F679E644C7AA

    Control-flow Graph

    APIs
    • GetSysColorBrush.USER32 ref: 00410326
    • RegisterClassExW.USER32 ref: 00410359
    • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
    • InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
    • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
    • ImageList_ReplaceIcon.COMCTL32(00A058A8,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
    • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
    • API String ID: 2914291525-1005189915
    • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
    • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
    • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
    • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A

    Control-flow Graph

    APIs
    • GetSysColorBrush.USER32(0000000F), ref: 004101F9
    • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
    • LoadIconW.USER32(?,00000063), ref: 0041021F
    • LoadIconW.USER32(?,000000A4), ref: 00410232
    • LoadIconW.USER32(?,000000A2), ref: 00410245
    • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
    • RegisterClassExW.USER32 ref: 004102C6
      • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
      • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
      • Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
      • Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
      • Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
      • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
      • Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(00A058A8,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
    • String ID: #$0$PGH
    • API String ID: 423443420-3673556320
    • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
    • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
    • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
    • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99

    Control-flow Graph

    APIs
    • _fseek.LIBCMT ref: 004525DA
      • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
      • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
      • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
      • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
      • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
      • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
      • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
    • __fread_nolock.LIBCMT ref: 00452618
    • __fread_nolock.LIBCMT ref: 00452629
    • __fread_nolock.LIBCMT ref: 00452644
    • __fread_nolock.LIBCMT ref: 00452661
    • _fseek.LIBCMT ref: 0045267D
    • _malloc.LIBCMT ref: 00452689
    • _malloc.LIBCMT ref: 00452696
    • __fread_nolock.LIBCMT ref: 004526A7
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __fread_nolock$_fseek_malloc_wcscpy
    • String ID:
    • API String ID: 1911931848-0
    • Opcode ID: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
    • Instruction ID: daf5751c9f96f1f9c2235ce4d63c31b1673d17b5fb5ed0b9a51dc370059b243a
    • Opcode Fuzzy Hash: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
    • Instruction Fuzzy Hash: 47514CB1A08340AFD310DF5AD881A9BF7E9FFC8704F40492EF68887241D77AE5448B5A

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 228 40f450-40f45c call 425210 231 40f460-40f478 228->231 231->231 232 40f47a-40f4a8 call 413990 call 410f70 231->232 237 40f4b0-40f4d1 call 4151b0 232->237 240 40f531 237->240 241 40f4d3-40f4da 237->241 242 40f536-40f540 240->242 243 40f4dc-40f4de 241->243 244 40f4fd-40f517 call 41557c 241->244 245 40f4e0-40f4e2 243->245 248 40f51c-40f51f 244->248 247 40f4e6-40f4ed 245->247 249 40f521-40f52c 247->249 250 40f4ef-40f4f2 247->250 248->237 251 40f543-40f54e 249->251 252 40f52e-40f52f 249->252 253 42937a-4293a0 call 41557c call 4151b0 250->253 254 40f4f8-40f4fb 250->254 255 40f550-40f553 251->255 256 40f555-40f560 251->256 252->250 264 4293a5-4293c3 call 4151d0 253->264 254->244 254->245 255->250 259 429372 256->259 260 40f566-40f571 256->260 259->253 262 429361-429367 260->262 263 40f577-40f57a 260->263 262->247 265 42936d 262->265 263->250 264->242 265->259
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __fread_nolock_fseek_strcat
    • String ID: AU3!$EA06
    • API String ID: 3818483258-2658333250
    • Opcode ID: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
    • Instruction ID: a326fe91d6bb541f17a8cee8b09d92be642ba4032c5aa5fe266a96c6f27d1a6c
    • Opcode Fuzzy Hash: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
    • Instruction Fuzzy Hash: 2B416C7160C340ABC331DA24C841AEB77A59B95308F68087EF5C597683E578E44A876B

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 268 410130-410142 SHGetMalloc 269 410148-410158 SHGetDesktopFolder 268->269 270 42944f-429459 call 411691 268->270 271 4101d1-4101e0 269->271 272 41015a-410188 call 411691 269->272 271->270 278 4101e6-4101ee 271->278 280 4101c5-4101ce 272->280 281 41018a-4101a1 SHGetPathFromIDListW 272->281 280->271 282 4101a3-4101b1 call 411691 281->282 283 4101b4-4101c0 281->283 282->283 283->280
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcscpy$DesktopFolderFromListMallocPath
    • String ID: C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe
    • API String ID: 192938534-2744400364
    • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
    • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
    • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
    • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 286 3eef210-3eef2be call 3eecc20 289 3eef2c5-3eef2eb call 3ef0120 CreateFileW 286->289 292 3eef2ed 289->292 293 3eef2f2-3eef302 289->293 294 3eef43d-3eef441 292->294 298 3eef309-3eef323 VirtualAlloc 293->298 299 3eef304 293->299 296 3eef483-3eef486 294->296 297 3eef443-3eef447 294->297 300 3eef489-3eef490 296->300 301 3eef449-3eef44c 297->301 302 3eef453-3eef457 297->302 305 3eef32a-3eef341 ReadFile 298->305 306 3eef325 298->306 299->294 307 3eef4e5-3eef4fa 300->307 308 3eef492-3eef49d 300->308 301->302 303 3eef459-3eef463 302->303 304 3eef467-3eef46b 302->304 303->304 311 3eef46d-3eef477 304->311 312 3eef47b 304->312 313 3eef348-3eef388 VirtualAlloc 305->313 314 3eef343 305->314 306->294 309 3eef4fc-3eef507 VirtualFree 307->309 310 3eef50a-3eef512 307->310 315 3eef49f 308->315 316 3eef4a1-3eef4ad 308->316 309->310 311->312 312->296 317 3eef38f-3eef3aa call 3ef0370 313->317 318 3eef38a 313->318 314->294 315->307 319 3eef4af-3eef4bf 316->319 320 3eef4c1-3eef4cd 316->320 326 3eef3b5-3eef3bf 317->326 318->294 322 3eef4e3 319->322 323 3eef4cf-3eef4d8 320->323 324 3eef4da-3eef4e0 320->324 322->300 323->322 324->322 327 3eef3f2-3eef406 call 3ef0180 326->327 328 3eef3c1-3eef3f0 call 3ef0370 326->328 334 3eef40a-3eef40e 327->334 335 3eef408 327->335 328->326 336 3eef41a-3eef41e 334->336 337 3eef410-3eef414 CloseHandle 334->337 335->294 338 3eef42e-3eef437 336->338 339 3eef420-3eef42b VirtualFree 336->339 337->336 338->289 338->294 339->338
    APIs
    • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 03EEF2E1
    • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 03EEF507
    Memory Dump Source
    • Source File: 00000000.00000002.1257423859.0000000003EEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EEC000, based on PE: false
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_3eec000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CreateFileFreeVirtual
    • String ID:
    • API String ID: 204039940-0
    • Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
    • Instruction ID: 9e9b8b8f1926818a7589d4aac692f10477210dc9551763d26e6064686b139422
    • Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
    • Instruction Fuzzy Hash: C1A12A75E04209EBDB14DFA4C894BEEBBB5FF48304F249299E105BB280D775AA42CF54

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 340 414f10-414f2c 341 414f4f 340->341 342 414f2e-414f31 340->342 344 414f51-414f55 341->344 342->341 343 414f33-414f35 342->343 345 414f37-414f46 call 417f23 343->345 346 414f56-414f5b 343->346 358 414f47-414f4c call 417ebb 345->358 348 414f6a-414f6d 346->348 349 414f5d-414f68 346->349 352 414f7a-414f7c 348->352 353 414f6f-414f77 call 4131f0 348->353 349->348 351 414f8b-414f9e 349->351 356 414fa0-414fa6 351->356 357 414fa8 351->357 352->345 355 414f7e-414f89 352->355 353->352 355->345 355->351 360 414faf-414fb1 356->360 357->360 358->341 362 4150a1-4150a4 360->362 363 414fb7-414fbe 360->363 362->344 365 414fc0-414fc5 363->365 366 415004-415007 363->366 365->366 369 414fc7 365->369 367 415071-415072 call 41e6b1 366->367 368 415009-41500d 366->368 375 415077-41507b 367->375 371 41500f-415018 368->371 372 41502e-415035 368->372 373 415102 369->373 374 414fcd-414fd1 369->374 376 415023-415028 371->376 377 41501a-415021 371->377 379 415037 372->379 380 415039-41503c 372->380 378 415106-41510f 373->378 381 414fd3 374->381 382 414fd5-414fd8 374->382 375->378 383 415081-415085 375->383 384 41502a-41502c 376->384 377->384 378->344 379->380 385 415042-41504e call 41453a call 41ed9e 380->385 386 4150d5-4150d9 380->386 381->382 387 4150a9-4150af 382->387 388 414fde-414fff call 41ee9b 382->388 383->386 391 415087-415096 383->391 384->380 408 415053-415058 385->408 389 4150eb-4150fd call 417f23 386->389 390 4150db-4150e8 call 4131f0 386->390 392 4150b1-4150bd call 4131f0 387->392 393 4150c0-4150d0 call 417f23 387->393 399 415099-41509b 388->399 389->358 390->389 391->399 392->393 393->358 399->362 399->363 409 415114-415118 408->409 410 41505e-415061 408->410 409->378 410->373 411 415067-41506f 410->411 411->399
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
    • String ID:
    • API String ID: 3886058894-0
    • Opcode ID: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
    • Instruction ID: 085ef53bf2cba992f8731f00f2d52beda6aca72a1b803249d76dffc069a60243
    • Opcode Fuzzy Hash: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
    • Instruction Fuzzy Hash: CA510830900604EFCB208FA9C8445DFBBB5EFC5324F24825BF82596290D7799ED2CB99

    Control-flow Graph

    APIs
    • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
      • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
    • _memset.LIBCMT ref: 00401C62
    • _wcsncpy.LIBCMT ref: 00401CA1
    • _wcscpy.LIBCMT ref: 00401CBD
    • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: IconLoadNotifyShell_String_memset_wcscpy_wcslen_wcsncpy
    • String ID: Line:
    • API String ID: 1620655955-1585850449
    • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
    • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
    • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
    • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 445 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
    APIs
    • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
    • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
    • ShowWindow.USER32(?,00000000), ref: 00410454
    • ShowWindow.USER32(?,00000000), ref: 0041045E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$CreateShow
    • String ID: AutoIt v3$edit
    • API String ID: 1584632944-3779509399
    • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
    • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
    • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
    • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 446 3eeefd0-3eef112 call 3eecc20 call 3eeeec0 CreateFileW 453 3eef119-3eef129 446->453 454 3eef114 446->454 457 3eef12b 453->457 458 3eef130-3eef14a VirtualAlloc 453->458 455 3eef1c9-3eef1ce 454->455 457->455 459 3eef14e-3eef165 ReadFile 458->459 460 3eef14c 458->460 461 3eef169-3eef1a3 call 3eeef00 call 3eedec0 459->461 462 3eef167 459->462 460->455 467 3eef1bf-3eef1c7 ExitProcess 461->467 468 3eef1a5-3eef1ba call 3eeef50 461->468 462->455 467->455 468->467
    APIs
      • Part of subcall function 03EEEEC0: Sleep.KERNELBASE(000001F4), ref: 03EEEED1
    • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 03EEF108
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1257423859.0000000003EEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EEC000, based on PE: false
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_3eec000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CreateFileSleep
    • String ID: R20C2NK1OXW5CLP
    • API String ID: 2694422964-1141285795
    • Opcode ID: 008bf734630542f15dc67b792bf3d1797a2c394f301a81f6bd95277ba48e8cb8
    • Instruction ID: 090a0f91b4089aeb84b31913e6d393aea70d75a987aaf1e6bcb8e3af22292c73
    • Opcode Fuzzy Hash: 008bf734630542f15dc67b792bf3d1797a2c394f301a81f6bd95277ba48e8cb8
    • Instruction Fuzzy Hash: 04519034D14248EAEF11DBB4C854BEEBB79AF58300F004699E208BB2C1D7B91B45CBA5

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 470 413a88-413a99 call 41718c 473 413b10-413b15 call 4171d1 470->473 474 413a9b-413aa2 470->474 476 413aa4-413abc call 418407 call 419f6d 474->476 477 413ae7 474->477 487 413ac7-413ad7 call 413ade 476->487 488 413abe-413ac6 call 419f9d 476->488 479 413ae8-413af8 RtlFreeHeap 477->479 479->473 481 413afa-413b0f call 417f23 GetLastError call 417ee1 479->481 481->473 487->473 495 413ad9-413adc 487->495 488->487 495->479
    APIs
    • __lock.LIBCMT ref: 00413AA6
      • Part of subcall function 00418407: __mtinitlocknum.LIBCMT ref: 0041841D
      • Part of subcall function 00418407: __amsg_exit.LIBCMT ref: 00418429
      • Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431
    • ___sbh_find_block.LIBCMT ref: 00413AB1
    • ___sbh_free_block.LIBCMT ref: 00413AC0
    • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
    • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
    • String ID:
    • API String ID: 2714421763-0
    • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
    • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
    • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
    • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
    APIs
      • Part of subcall function 0040F580: _wcslen.LIBCMT ref: 0040F58A
      • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0040F5A3
      • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,-00000010,00000001,?,?,?,?), ref: 0040F5CC
    • _strcat.LIBCMT ref: 0040F603
      • Part of subcall function 0040F6A0: _memset.LIBCMT ref: 0040F6A8
      • Part of subcall function 0040F6D0: _strlen.LIBCMT ref: 0040F6D8
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ByteCharMultiWide$_memset_strcat_strlen_wcslen
    • String ID: HH
    • API String ID: 1194219731-2761332787
    • Opcode ID: ee47fd20779ff5886c3c730aa44a1efa7791f275b5868e90dcef310a8da63108
    • Instruction ID: 1fd31f67f6889806bd2ce24d6488871f5ee50ddf162d20410a363c4a19aba518
    • Opcode Fuzzy Hash: ee47fd20779ff5886c3c730aa44a1efa7791f275b5868e90dcef310a8da63108
    • Instruction Fuzzy Hash: 022158B260825067C724EF7A9C8266EF7D8AF85308F148C3FF554D2282F638D555879A
    APIs
    • CreateProcessW.KERNELBASE(?,00000000), ref: 03EEE67B
    • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03EEE711
    • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03EEE733
    Memory Dump Source
    • Source File: 00000000.00000002.1257423859.0000000003EEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EEC000, based on PE: false
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_3eec000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Process$ContextCreateMemoryReadThreadWow64
    • String ID:
    • API String ID: 2438371351-0
    • Opcode ID: ec40cea32e34b77dc66852b254e16eb814eeb5cb53dbe13a3b9b961a1e41453f
    • Instruction ID: 556bd709ca93b427d1f76f0743d30db12df13f8b7ccef802f9b9fb09d6b7a912
    • Opcode Fuzzy Hash: ec40cea32e34b77dc66852b254e16eb814eeb5cb53dbe13a3b9b961a1e41453f
    • Instruction Fuzzy Hash: B262FB34A142589BEB24CFA4C850BDEB376FF58304F1091A9D10DEB394E7769E81CB59
    APIs
    • _memset.LIBCMT ref: 0040E202
    • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: IconNotifyShell__memset
    • String ID:
    • API String ID: 928536360-0
    • Opcode ID: 27b28fb85d639681eb8fd2a3c2bcd9dc0bb82ef5f5c365fc5a47124cd6911170
    • Instruction ID: 9c6d99eda8392314e00a4319cd3b9f491a6d528882fc0aac3328a2d60ab56ec1
    • Opcode Fuzzy Hash: 27b28fb85d639681eb8fd2a3c2bcd9dc0bb82ef5f5c365fc5a47124cd6911170
    • Instruction Fuzzy Hash: FC318170608701DFD320DF25D845B97BBF8BB45304F00486EE99A93380E778A958CF5A
    APIs
    • _malloc.LIBCMT ref: 00411734
      • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
      • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
      • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
    • std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
      • Part of subcall function 004116B0: std::exception::exception.LIBCMT ref: 004116BC
    • std::bad_exception::bad_exception.LIBCMT ref: 0041176B
    • __CxxThrowException@8.LIBCMT ref: 00411779
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
    • String ID:
    • API String ID: 1411284514-0
    • Opcode ID: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
    • Instruction ID: c554e94cc15d94fff19a40754e7570613bf3612ee9c26c673f8185df9075a277
    • Opcode Fuzzy Hash: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
    • Instruction Fuzzy Hash: 6FF0E23550060A66CF08B723EC06ADE3B649F11798B10403BFA20552F2DF6DADC9865C
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
    • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
    • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
    • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
    APIs
    • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
    • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
    • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CloseOpenQueryValue
    • String ID:
    • API String ID: 3677997916-0
    • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
    • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
    • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
    • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
    APIs
    • _malloc.LIBCMT ref: 00435278
      • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
      • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
      • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
    • _malloc.LIBCMT ref: 00435288
    • _malloc.LIBCMT ref: 00435298
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _malloc$AllocateHeap
    • String ID:
    • API String ID: 680241177-0
    • Opcode ID: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
    • Instruction ID: 30b75876ff52ae1c35022de4a6700901ba1db26c97f4d16f7fcf584af9a5a73f
    • Opcode Fuzzy Hash: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
    • Instruction Fuzzy Hash: E5F0A0B1500F0046E660AB3198457C7A2E09B14307F00186FB6855618ADA7C69C4CEAC
    APIs
    • _wcslen.LIBCMT ref: 00401B71
      • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
      • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
      • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
      • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Exception@8Throw_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
    • String ID: @EXITCODE
    • API String ID: 580348202-3436989551
    • Opcode ID: 4145ab2d07bf19a354fff2d5031cf88e997e0915ee9c5273387e54f5573defd1
    • Instruction ID: 288ad252d7dad0c090ff8240dee62855692e698d70424b42c0a66861a7771545
    • Opcode Fuzzy Hash: 4145ab2d07bf19a354fff2d5031cf88e997e0915ee9c5273387e54f5573defd1
    • Instruction Fuzzy Hash: 73F06DF2A002025BD7649B35DC0276776E4AB44704F18C83EE14AC7791F6BDE8829B15
    APIs
    • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
    • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CreateFile
    • String ID:
    • API String ID: 823142352-0
    • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
    • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
    • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
    • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __lock_file_memset
    • String ID:
    • API String ID: 26237723-0
    • Opcode ID: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
    • Instruction ID: c8a12bf2a45d0ac11074f8cac28b928f9e20b60047ac9024d749846706a082ab
    • Opcode Fuzzy Hash: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
    • Instruction Fuzzy Hash: 32012971C00609FBCF22AF65DC029DF3B31AF44714F04815BF82416261D7798AA2DF99
    APIs
      • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
      • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
    • __lock_file.LIBCMT ref: 00414EE4
      • Part of subcall function 00415965: __lock.LIBCMT ref: 0041598A
    • __fclose_nolock.LIBCMT ref: 00414EEE
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
    • String ID:
    • API String ID: 717694121-0
    • Opcode ID: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
    • Instruction ID: 225a509e04b880138f2478077c57af59103cae2c072c29012e7845c0956b1514
    • Opcode Fuzzy Hash: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
    • Instruction Fuzzy Hash: DEF06270D0470499C721BB6A9802ADE7AB0AFC1338F21864FE479A72D1C77C46C29F5D
    APIs
    • CreateProcessW.KERNELBASE(?,00000000), ref: 03EEE67B
    • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03EEE711
    • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03EEE733
    Memory Dump Source
    • Source File: 00000000.00000002.1257423859.0000000003EEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EEC000, based on PE: false
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_3eec000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Process$ContextCreateMemoryReadThreadWow64
    • String ID:
    • API String ID: 2438371351-0
    • Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
    • Instruction ID: 39ae88decb925b8ad9580fa7b358896e2186be9e32bbaf30e8d14b7c698a2a43
    • Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
    • Instruction Fuzzy Hash: 2912CF24E24658C6EB24DF64D8507DEB232FF68300F1061E9910DEB7A5E77A4E81CF5A
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ProtectVirtual
    • String ID:
    • API String ID: 544645111-0
    • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
    • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
    • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
    • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 0d8ad4d875158e0120ed104e09085659f42b86f6d600f5d33fa38308f41241bf
    • Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
    • Opcode Fuzzy Hash: 0d8ad4d875158e0120ed104e09085659f42b86f6d600f5d33fa38308f41241bf
    • Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E
    APIs
    • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ProcWindow
    • String ID:
    • API String ID: 181713994-0
    • Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
    • Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
    • Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
    • Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E
    APIs
    • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CreateHeap
    • String ID:
    • API String ID: 10892065-0
    • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
    • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
    • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
    • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
    APIs
      • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
    • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: File$PointerWrite
    • String ID:
    • API String ID: 539440098-0
    • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
    • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
    • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
    • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
    APIs
    • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ProcWindow
    • String ID:
    • API String ID: 181713994-0
    • Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
    • Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
    • Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
    • Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __wfsopen
    • String ID:
    • API String ID: 197181222-0
    • Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
    • Instruction ID: 6225ca515e7db1e5d7746fb8cf1e0ad45b41b4d1817cc5a1d8a93eb941133566
    • Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
    • Instruction Fuzzy Hash: EDC09B7644010C77CF122943FC02E453F1997C0764F044011FB1C1D561D577D5619589
    APIs
    • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CloseHandle
    • String ID:
    • API String ID: 2962429428-0
    • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
    • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
    • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
    • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
    APIs
    • Sleep.KERNELBASE(000001F4), ref: 03EEEED1
    Memory Dump Source
    • Source File: 00000000.00000002.1257423859.0000000003EEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EEC000, based on PE: false
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_3eec000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Sleep
    • String ID:
    • API String ID: 3472027048-0
    • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
    • Instruction ID: 955a24cd03327e53a39be7f9f3673982cff011c1b8cad6df44ea91674133b857
    • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
    • Instruction Fuzzy Hash: 45E0E67494010DDFDB00EFF8D5496AE7FB4EF04301F1002A1FD01D2290D6309D508A62
    APIs
    • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
    • DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
    • GetKeyState.USER32(00000011), ref: 0047C1A4
    • GetKeyState.USER32(00000009), ref: 0047C1AD
    • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
    • GetKeyState.USER32(00000010), ref: 0047C1CA
    • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
    • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
    • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
    • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
    • SendMessageW.USER32 ref: 0047C2FB
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$State$LongProcWindow
    • String ID: @GUI_DRAGID$F
    • API String ID: 1562745308-4164748364
    • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
    • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
    • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
    • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID: PF$'|G$*"D$*vG$+%F$0wE$2G$5CG$7eF$<HF$<G$ApG$DvE$GSG$IqE$K@G$LbF$MdF$NgF$PIF$YtG$^[F$_?G$b"D$i}G$j)F$kQG$lE$rTG$vjE$}eE$*F$3G$_G$wG
    • API String ID: 0-3772701627
    • Opcode ID: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
    • Instruction ID: b1e67458769bbea4a86cd8903524db5b6e79558e2e7ab8c51025fc7bd56032a7
    • Opcode Fuzzy Hash: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
    • Instruction Fuzzy Hash: 118366F1905B409FC351DFAAF984605BAE1F3AA3157A2857FC5088B731D7B8194A8F4C
    APIs
    • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
    • IsIconic.USER32(?), ref: 004375E1
    • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
    • SetForegroundWindow.USER32(?), ref: 004375FD
    • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
    • GetCurrentThreadId.KERNEL32 ref: 00437619
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
    • SetForegroundWindow.USER32(?), ref: 00437645
    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
    • keybd_event.USER32(00000012,00000000), ref: 0043765D
    • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
    • keybd_event.USER32(00000012,00000000), ref: 00437674
    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
    • keybd_event.USER32(00000012,00000000), ref: 0043768B
    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
    • keybd_event.USER32(00000012,00000000), ref: 004376A2
    • SetForegroundWindow.USER32(?), ref: 004376AD
    • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
    • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
    • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
    • String ID: Shell_TrayWnd
    • API String ID: 3778422247-2988720461
    • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
    • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
    • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
    • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
    APIs
    • _memset.LIBCMT ref: 0044621B
    • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
    • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
    • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
    • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
    • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
    • _wcslen.LIBCMT ref: 0044639E
      • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
    • _wcsncpy.LIBCMT ref: 004463C7
    • LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
    • CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
    • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
    • UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
    • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
    • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
    • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
    • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
    • DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_memset_wcslen_wcsncpy
    • String ID: $default$winsta0
    • API String ID: 2173856841-1027155976
    • Opcode ID: 46fbf0c91f7472a5aacc8247470ef491aaba77adfafaecf219e6b528db50d2b4
    • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
    • Opcode Fuzzy Hash: 46fbf0c91f7472a5aacc8247470ef491aaba77adfafaecf219e6b528db50d2b4
    • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
    APIs
    • _wcslen.LIBCMT ref: 00409A61
      • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
      • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
      • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
      • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
    • CharUpperBuffW.USER32(?,?), ref: 00409AF5
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
    • String ID: 0vH$4RH
    • API String ID: 1143807570-2085553193
    • Opcode ID: 88a19b4cc9c9a9d83f3f9e2de6433f25e45d54e9704eefe367a70e6a3dd99c42
    • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
    • Opcode Fuzzy Hash: 88a19b4cc9c9a9d83f3f9e2de6433f25e45d54e9704eefe367a70e6a3dd99c42
    • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B
    APIs
      • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,?,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,004A8E80,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,0040F3D2), ref: 0040FFCA
      • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A45
      • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A6C
      • Part of subcall function 00436A1D: __wcsicoll.LIBCMT ref: 00436A93
      • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
    • _wcscat.LIBCMT ref: 0044BD96
    • _wcscat.LIBCMT ref: 0044BDBF
    • __wsplitpath.LIBCMT ref: 0044BDEC
    • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
    • _wcscpy.LIBCMT ref: 0044BE73
    • _wcscat.LIBCMT ref: 0044BE85
    • _wcscat.LIBCMT ref: 0044BE97
    • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
    • DeleteFileW.KERNEL32(?), ref: 0044BED5
    • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
    • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
    • DeleteFileW.KERNEL32(?), ref: 0044BF17
    • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
    • FindClose.KERNEL32(00000000), ref: 0044BF35
    • MoveFileW.KERNEL32(?,?), ref: 0044BF51
    • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
    • FindClose.KERNEL32(00000000), ref: 0044BF7E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
    • String ID: \*.*
    • API String ID: 2188072990-1173974218
    • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
    • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
    • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
    • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
    APIs
    • __invoke_watson.LIBCMT ref: 004203A4
      • Part of subcall function 00417D93: _memset.LIBCMT ref: 00417DBB
      • Part of subcall function 00417D93: IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00417E6F
      • Part of subcall function 00417D93: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00417E79
      • Part of subcall function 00417D93: UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00417E86
      • Part of subcall function 00417D93: GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00417EA1
      • Part of subcall function 00417D93: TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00417EA8
    • __get_daylight.LIBCMT ref: 004203B0
    • __invoke_watson.LIBCMT ref: 004203BF
    • __get_daylight.LIBCMT ref: 004203CB
    • __invoke_watson.LIBCMT ref: 004203DA
    • ____lc_codepage_func.LIBCMT ref: 004203E2
    • _strlen.LIBCMT ref: 00420442
    • __malloc_crt.LIBCMT ref: 00420449
    • _strlen.LIBCMT ref: 0042045F
    • _strcpy_s.LIBCMT ref: 0042046D
    • __invoke_watson.LIBCMT ref: 00420482
    • GetTimeZoneInformation.KERNEL32(00496C28), ref: 004204AA
    • WideCharToMultiByte.KERNEL32(?,?,00496C2C,?,?,0000003F,?,?), ref: 00420528
    • WideCharToMultiByte.KERNEL32(?,?,00496C80,000000FF,?,0000003F,?,?,?,00496C2C,?,?,0000003F,?,?), ref: 0042055C
      • Part of subcall function 00413A88: __lock.LIBCMT ref: 00413AA6
      • Part of subcall function 00413A88: ___sbh_find_block.LIBCMT ref: 00413AB1
      • Part of subcall function 00413A88: ___sbh_free_block.LIBCMT ref: 00413AC0
      • Part of subcall function 00413A88: RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
      • Part of subcall function 00413A88: GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
    • __invoke_watson.LIBCMT ref: 004205CC
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __invoke_watson$ByteCharExceptionFilterMultiProcessUnhandledWide__get_daylight_strlen$CurrentDebuggerErrorFreeHeapInformationLastPresentTerminateTimeZone____lc_codepage_func___sbh_find_block___sbh_free_block__lock__malloc_crt_memset_strcpy_s
    • String ID: S\
    • API String ID: 4084823496-393906132
    • Opcode ID: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
    • Instruction ID: b357f19af7064e56bcdb8625987f67de7edc2332d57e558cb2e7b84f91b73af7
    • Opcode Fuzzy Hash: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
    • Instruction Fuzzy Hash: 6A91D371E00125AFDB20EF65EC819AE7BE9EF55300B95003BF540A7253DA3C89828F5C
    APIs
    • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
    • __swprintf.LIBCMT ref: 00434D91
    • _wcslen.LIBCMT ref: 00434D9B
    • _wcslen.LIBCMT ref: 00434DB0
    • _wcslen.LIBCMT ref: 00434DC5
    • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
    • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
    • _memset.LIBCMT ref: 00434E27
    • _wcslen.LIBCMT ref: 00434E3C
    • _wcsncpy.LIBCMT ref: 00434E6F
    • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
    • CloseHandle.KERNEL32(00000000), ref: 00434EB4
    • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
    • CloseHandle.KERNEL32(00000000), ref: 00434ECE
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcslen$CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
    • String ID: :$\$\??\%s
    • API String ID: 302090198-3457252023
    • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
    • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
    • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
    • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
    APIs
      • Part of subcall function 00444233: _wcslen.LIBCMT ref: 0044424E
    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
    • GetLastError.KERNEL32 ref: 004644B4
    • GetCurrentThread.KERNEL32 ref: 004644C8
    • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
    • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
    • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: OpenProcess$CurrentThreadToken$ErrorLast_wcslen
    • String ID: SeDebugPrivilege
    • API String ID: 1312810259-2896544425
    • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
    • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
    • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
    • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
    APIs
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
    • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
    • __wsplitpath.LIBCMT ref: 004038B2
      • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
    • _wcscpy.LIBCMT ref: 004038C7
    • _wcscat.LIBCMT ref: 004038DC
    • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
      • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
      • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
      • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
      • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
      • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
      • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
    • _wcscpy.LIBCMT ref: 004039C2
    • _wcslen.LIBCMT ref: 00403A53
    • _wcslen.LIBCMT ref: 00403AAA
    Strings
    • Unterminated string, xrefs: 0042B9BA
    • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
    • Error opening the file, xrefs: 0042B8AC
    • _, xrefs: 00403B48
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpy$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_wcscatstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
    • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
    • API String ID: 4115725249-188983378
    • Opcode ID: 03e6ea20781e53ba093b2e4e1cf17e7e885813b4a055a64ca381d3f5bd1a9c3d
    • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
    • Opcode Fuzzy Hash: 03e6ea20781e53ba093b2e4e1cf17e7e885813b4a055a64ca381d3f5bd1a9c3d
    • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
    APIs
    • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
    • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
    • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
    • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
    • FindClose.KERNEL32(00000000), ref: 00434C88
    • FindClose.KERNEL32(00000000), ref: 00434C9C
    • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
    • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
    • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
    • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
    • FindClose.KERNEL32(00000000), ref: 00434D35
    • FindClose.KERNEL32(00000000), ref: 00434D43
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
    • String ID: *.*
    • API String ID: 1409584000-438819550
    • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
    • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
    • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
    • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Timetime$Sleep
    • String ID: BUTTON
    • API String ID: 4176159691-3405671355
    • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
    • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
    • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
    • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
    APIs
      • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
      • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
      • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
      • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
    • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
    • _memset.LIBCMT ref: 00445E61
    • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
    • GetLengthSid.ADVAPI32(?), ref: 00445E92
    • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
    • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
    • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
    • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
    • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
    • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
    • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
    • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast_memset
    • String ID:
    • API String ID: 3490752873-0
    • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
    • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
    • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
    • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
    APIs
    • OleInitialize.OLE32(00000000), ref: 0047AA03
    • CLSIDFromProgID.OLE32(00000000,?), ref: 0047AA27
    • CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
    • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
    • _memset.LIBCMT ref: 0047AB7C
    • _wcslen.LIBCMT ref: 0047AC68
    • _memset.LIBCMT ref: 0047ACCD
    • CoCreateInstanceEx.OLE32 ref: 0047AD06
    • CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
    Strings
    • NULL Pointer assignment, xrefs: 0047AD84
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity_wcslen
    • String ID: NULL Pointer assignment
    • API String ID: 1588287285-2785691316
    • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
    • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
    • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
    • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
    APIs
    • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
    • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
    • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
    • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
    • GetLastError.KERNEL32 ref: 00436504
    • ExitWindowsEx.USER32(?,00000000), ref: 00436527
    • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
    • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
    • String ID: SeShutdownPrivilege
    • API String ID: 2938487562-3733053543
    • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
    • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
    • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
    • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
    APIs
    • __swprintf.LIBCMT ref: 00436162
    • __swprintf.LIBCMT ref: 00436176
      • Part of subcall function 0041353A: __woutput_l.LIBCMT ref: 0041358F
    • __wcsicoll.LIBCMT ref: 00436185
    • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
    • LoadResource.KERNEL32(?,00000000), ref: 004361AE
    • LockResource.KERNEL32(00000000), ref: 004361B5
    • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
    • LoadResource.KERNEL32(?,00000000), ref: 004361E4
    • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
    • LockResource.KERNEL32(?), ref: 004361FD
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll__woutput_l
    • String ID:
    • API String ID: 2406429042-0
    • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
    • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
    • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
    • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
    APIs
    • SetErrorMode.KERNEL32(00000001), ref: 0045D522
    • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
    • GetLastError.KERNEL32 ref: 0045D59D
    • SetErrorMode.KERNEL32(?), ref: 0045D629
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Error$Mode$DiskFreeLastSpace
    • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
    • API String ID: 4194297153-14809454
    • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
    • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
    • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
    • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
    APIs
    • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
      • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
      • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
      • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
      • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
    • OleInitialize.OLE32(00000000), ref: 0047AE06
      • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
      • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
    • _wcslen.LIBCMT ref: 0047AE18
    • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
    • CLSIDFromProgID.OLE32(00000000,?,?), ref: 0047AFCC
    • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CopyVariant$_wcslen$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg_wcscpy
    • String ID: HH
    • API String ID: 1915432386-2761332787
    • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
    • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
    • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
    • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID: DEFINE$`$h$h
    • API String ID: 0-4194577831
    • Opcode ID: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
    • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
    • Opcode Fuzzy Hash: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
    • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
    APIs
    • socket.WSOCK32(00000002,00000001,00000006,?,00000000), ref: 004648B0
    • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
    • bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648DA
    • WSAGetLastError.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
    • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000005,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 0046492D
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ErrorLast$bindclosesocketsocket
    • String ID:
    • API String ID: 2609815416-0
    • Opcode ID: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
    • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
    • Opcode Fuzzy Hash: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
    • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
    APIs
    • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
    • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
    • Process32NextW.KERNEL32(00000000,?), ref: 00437075
    • __wsplitpath.LIBCMT ref: 004370A5
      • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
    • _wcscat.LIBCMT ref: 004370BA
    • __wcsicoll.LIBCMT ref: 004370C8
    • CloseHandle.KERNEL32(00000000,?), ref: 00437105
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
    • String ID:
    • API String ID: 2547909840-0
    • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
    • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
    • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
    • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
    APIs
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
    • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
    • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
    • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Find$File$CloseFirstNextSleep_wcslen
    • String ID: *.*
    • API String ID: 2693929171-438819550
    • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
    • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
    • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
    • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
    APIs
    • OpenClipboard.USER32(?), ref: 0046C635
    • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
    • GetClipboardData.USER32(0000000D), ref: 0046C64F
    • CloseClipboard.USER32 ref: 0046C65D
    • GlobalLock.KERNEL32(00000000), ref: 0046C688
    • CloseClipboard.USER32 ref: 0046C692
    • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
    • GetClipboardData.USER32(00000001), ref: 0046C6DD
    • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
    • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
    • CloseClipboard.USER32 ref: 0046C866
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
    • String ID: HH
    • API String ID: 589737431-2761332787
    • Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
    • Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
    • Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
    • Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA
    APIs
    • __wcsicoll.LIBCMT ref: 0043643C
    • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
    • __wcsicoll.LIBCMT ref: 00436466
    • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __wcsicollmouse_event
    • String ID: DOWN
    • API String ID: 1033544147-711622031
    • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
    • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
    • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
    • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
    APIs
      • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
    • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 00474213
    • WSAGetLastError.WSOCK32(00000000), ref: 00474233
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ErrorLastinet_addrsocket
    • String ID:
    • API String ID: 4170576061-0
    • Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
    • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
    • Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
    • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
    APIs
    • GetCursorPos.USER32(004A83D8), ref: 0045636A
    • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
    • GetAsyncKeyState.USER32(?), ref: 004563D0
    • GetAsyncKeyState.USER32(?), ref: 004563DC
    • GetWindowLongW.USER32(?,000000F0), ref: 00456430
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AsyncState$ClientCursorLongScreenWindow
    • String ID:
    • API String ID: 3539004672-0
    • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
    • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
    • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
    • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
    APIs
      • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
    • IsWindowVisible.USER32 ref: 00477314
    • IsWindowEnabled.USER32 ref: 00477324
    • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
    • IsIconic.USER32 ref: 0047733F
    • IsZoomed.USER32 ref: 0047734D
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$EnabledForegroundIconicVisibleZoomed
    • String ID:
    • API String ID: 292994002-0
    • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
    • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
    • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
    • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
    APIs
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,771B3220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
    • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
    • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: File$CloseCreateHandleTime
    • String ID:
    • API String ID: 3397143404-0
    • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
    • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
    • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
    • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _strncmp
    • String ID: ACCEPT$^$h
    • API String ID: 909875538-4263704089
    • Opcode ID: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
    • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
    • Opcode Fuzzy Hash: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
    • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID: ERCP$VUUU$VUUU$VUUU
    • API String ID: 0-2165971703
    • Opcode ID: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
    • Instruction ID: 514654dd073cfe12bfc68f6c44a091d7a3824994b709b832431b3f3de6bbd106
    • Opcode Fuzzy Hash: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
    • Instruction Fuzzy Hash: 5562D3716087818BE734CF18C8807ABB7E1EBC6314F154A2FE49986390E779D949CB5B
    APIs
    • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
    • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
    • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Find$File$CloseFirstNext
    • String ID:
    • API String ID: 3541575487-0
    • Opcode ID: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
    • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
    • Opcode Fuzzy Hash: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
    • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
    APIs
    • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
    • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
    • FindClose.KERNEL32(00000000), ref: 00436B13
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: FileFind$AttributesCloseFirst
    • String ID:
    • API String ID: 48322524-0
    • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
    • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
    • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
    • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
    APIs
    • __time64.LIBCMT ref: 004433A2
      • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
      • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Time$FileSystem__aulldiv__time64
    • String ID: rJ
    • API String ID: 2893107130-1865492326
    • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
    • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
    • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
    • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
    APIs
    • __time64.LIBCMT ref: 004433A2
      • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
      • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Time$FileSystem__aulldiv__time64
    • String ID: rJ
    • API String ID: 2893107130-1865492326
    • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
    • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
    • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
    • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
    APIs
    • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
    • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
      • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Internet$AvailableDataErrorFileLastQueryRead
    • String ID:
    • API String ID: 901099227-0
    • Opcode ID: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
    • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
    • Opcode Fuzzy Hash: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
    • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
    APIs
    • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
    • FindClose.KERNEL32(00000000), ref: 0045DDDD
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Find$CloseFileFirst
    • String ID:
    • API String ID: 2295610775-0
    • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
    • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
    • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
    • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID: 0vH$HH
    • API String ID: 0-728391547
    • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
    • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
    • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
    • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _memset
    • String ID:
    • API String ID: 2102423945-0
    • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
    • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
    • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
    • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
    APIs
    • DefDlgProcW.USER32(?,?,?,?,004A83D8,?), ref: 0047E22C
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Proc
    • String ID:
    • API String ID: 2346855178-0
    • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
    • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
    • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
    • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
    APIs
    • BlockInput.USER32(00000001), ref: 0045A272
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: BlockInput
    • String ID:
    • API String ID: 3456056419-0
    • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
    • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
    • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
    • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
    APIs
    • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: LogonUser
    • String ID:
    • API String ID: 1244722697-0
    • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
    • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
    • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
    • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: NameUser
    • String ID:
    • API String ID: 2645101109-0
    • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
    • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
    • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
    • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
    APIs
    • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ExceptionFilterUnhandled
    • String ID:
    • API String ID: 3192549508-0
    • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
    • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
    • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
    • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
    • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
    • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
    • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
    • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
    • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
    • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
    • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
    • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
    • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
    • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
    • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
    • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
    Memory Dump Source
    • Source File: 00000000.00000002.1257423859.0000000003EEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EEC000, based on PE: false
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_3eec000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
    • Instruction ID: 225b505fa8d6bf38733d83a552a9642adcf220fdcac1862045b91cc2703b34e6
    • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
    • Instruction Fuzzy Hash: C441D271D1051CEBCF48CFADC890AAEBBF2AF88201F548299D516AB345D730AB01DB40
    Memory Dump Source
    • Source File: 00000000.00000002.1257423859.0000000003EEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EEC000, based on PE: false
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_3eec000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
    • Instruction ID: ab80ac2240b61148a9384461e8453932b957b62a6771f5f4b90666c132d97c5d
    • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
    • Instruction Fuzzy Hash: B8014279A01209EFCB48DF98C5909AEF7B5FB88310F2486D9D919A7745E730AE41DB80
    Memory Dump Source
    • Source File: 00000000.00000002.1257423859.0000000003EEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EEC000, based on PE: false
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_3eec000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
    • Instruction ID: 27bde646999226b9c3b2b324949c314c63b25f26e320d437013e5185fe83df7e
    • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
    • Instruction Fuzzy Hash: 08019278A00209EFCB44DF98C5909AEF7B5FB48310F608699D909A7301E730AE41DB80
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
    • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
    • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
    • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
    Memory Dump Source
    • Source File: 00000000.00000002.1257423859.0000000003EEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 03EEC000, based on PE: false
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_3eec000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
    • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
    • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
    • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
    APIs
    • DeleteObject.GDI32(?), ref: 004593D7
    • DeleteObject.GDI32(?), ref: 004593F1
    • DestroyWindow.USER32(?), ref: 00459407
    • GetDesktopWindow.USER32 ref: 0045942A
    • GetWindowRect.USER32(00000000), ref: 00459431
    • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
    • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
    • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
    • GetClientRect.USER32(00000000,?), ref: 004595C8
    • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
    • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
    • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
    • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
    • GlobalLock.KERNEL32(00000000), ref: 00459668
    • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
    • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
    • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
    • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
    • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
    • GlobalFree.KERNEL32(00000000), ref: 004596C0
    • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
    • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
    • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
    • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
    • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
    • GetStockObject.GDI32(00000011), ref: 004597B7
    • SelectObject.GDI32(00000000,00000000), ref: 004597BF
    • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
    • DeleteDC.GDI32(00000000), ref: 004597E1
    • _wcslen.LIBCMT ref: 00459800
    • _wcscpy.LIBCMT ref: 0045981F
    • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
    • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
    • GetDC.USER32(?), ref: 004598DE
    • SelectObject.GDI32(00000000,?), ref: 004598EE
    • SelectObject.GDI32(00000000,?), ref: 00459919
    • ReleaseDC.USER32(?,00000000), ref: 00459925
    • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
    • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
    • String ID: $AutoIt v3$DISPLAY$static
    • API String ID: 4040870279-2373415609
    • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
    • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
    • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
    • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
    APIs
    • GetSysColor.USER32(00000012), ref: 00441E64
    • SetTextColor.GDI32(?,?), ref: 00441E6C
    • GetSysColorBrush.USER32(0000000F), ref: 00441E83
    • GetSysColor.USER32(0000000F), ref: 00441E8F
    • SetBkColor.GDI32(?,?), ref: 00441EAA
    • SelectObject.GDI32(?,?), ref: 00441EBA
    • InflateRect.USER32(?,000000FF,000000FF), ref: 00441EF0
    • GetSysColor.USER32(00000010), ref: 00441EF8
    • CreateSolidBrush.GDI32(00000000), ref: 00441EFF
    • FrameRect.USER32(?,?,00000000), ref: 00441F10
    • DeleteObject.GDI32(?), ref: 00441F1B
    • InflateRect.USER32(?,000000FE,000000FE), ref: 00441F75
    • FillRect.USER32(?,?,?), ref: 00441FB6
      • Part of subcall function 00433D5C: GetSysColor.USER32(0000000E), ref: 00433D81
      • Part of subcall function 00433D5C: SetTextColor.GDI32(?,00000000), ref: 00433D89
      • Part of subcall function 00433D5C: GetSysColorBrush.USER32(0000000F), ref: 00433DBF
      • Part of subcall function 00433D5C: GetSysColor.USER32(0000000F), ref: 00433DCB
      • Part of subcall function 00433D5C: GetSysColor.USER32(00000011), ref: 00433DEB
      • Part of subcall function 00433D5C: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
      • Part of subcall function 00433D5C: SelectObject.GDI32(?,00000000), ref: 00433E0D
      • Part of subcall function 00433D5C: SetBkColor.GDI32(?,?), ref: 00433E19
      • Part of subcall function 00433D5C: SelectObject.GDI32(?,?), ref: 00433E29
      • Part of subcall function 00433D5C: InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
      • Part of subcall function 00433D5C: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
      • Part of subcall function 00433D5C: GetWindowLongW.USER32 ref: 00433E8A
      • Part of subcall function 00433D5C: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Color$Rect$Object$BrushInflateSelect$CreateText$DeleteFillFrameLongMessageRoundSendSolidWindow
    • String ID:
    • API String ID: 69173610-0
    • Opcode ID: 8d7e9eb6a1476829fb4e0a957564412aa33fdc92885306090b82eefa456b01e4
    • Instruction ID: 0b0c06e318eae1aa70623bc76f746578ebcda4f465cb69034399d4c57c44293d
    • Opcode Fuzzy Hash: 8d7e9eb6a1476829fb4e0a957564412aa33fdc92885306090b82eefa456b01e4
    • Instruction Fuzzy Hash: BBB14D71508300AFD314DF64DD88A6FB7F8FB88720F504A2DF996922A0D774E845CB66
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __wcsnicmp
    • String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
    • API String ID: 1038674560-3360698832
    • Opcode ID: c74d0d52908dbbec4f5022c33a9c4844136c2b84c95de0bb8b15b994b6f8f789
    • Instruction ID: b6083b7aed1673b33e689ff2aa7e8f17f47d7310e90ec65f4167159f85ee96f3
    • Opcode Fuzzy Hash: c74d0d52908dbbec4f5022c33a9c4844136c2b84c95de0bb8b15b994b6f8f789
    • Instruction Fuzzy Hash: 5A611471B4071076EA306A229C46FAB735CDF14345F50052FFC01A628BE7ADDA4A86EE
    APIs
    • GetSysColor.USER32(0000000E), ref: 00433D81
    • SetTextColor.GDI32(?,00000000), ref: 00433D89
    • GetSysColor.USER32(00000012), ref: 00433DA3
    • SetTextColor.GDI32(?,?), ref: 00433DAB
    • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
    • GetSysColor.USER32(0000000F), ref: 00433DCB
    • CreateSolidBrush.GDI32(?), ref: 00433DD4
    • GetSysColor.USER32(00000011), ref: 00433DEB
    • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
    • SelectObject.GDI32(?,00000000), ref: 00433E0D
    • SetBkColor.GDI32(?,?), ref: 00433E19
    • SelectObject.GDI32(?,?), ref: 00433E29
    • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
    • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
    • GetWindowLongW.USER32 ref: 00433E8A
    • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
    • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
    • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
    • DrawFocusRect.USER32(?,?), ref: 00433F1F
    • GetSysColor.USER32(00000011), ref: 00433F2E
    • SetTextColor.GDI32(?,00000000), ref: 00433F36
    • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
    • SelectObject.GDI32(?,?), ref: 00433F63
    • DeleteObject.GDI32(?), ref: 00433F70
    • SelectObject.GDI32(?,?), ref: 00433F78
    • DeleteObject.GDI32(00000000), ref: 00433F7B
    • SetTextColor.GDI32(?,?), ref: 00433F83
    • SetBkColor.GDI32(?,?), ref: 00433F8F
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
    • String ID:
    • API String ID: 1582027408-0
    • Opcode ID: aa49e6287f5c8eaa4963889518cb643ef6cff4134c3562cc94785d6825a4d511
    • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
    • Opcode Fuzzy Hash: aa49e6287f5c8eaa4963889518cb643ef6cff4134c3562cc94785d6825a4d511
    • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
    APIs
    • OpenClipboard.USER32(?), ref: 0046C635
    • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
    • GetClipboardData.USER32(0000000D), ref: 0046C64F
    • CloseClipboard.USER32 ref: 0046C65D
    • GlobalLock.KERNEL32(00000000), ref: 0046C688
    • CloseClipboard.USER32 ref: 0046C692
    • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
    • GetClipboardData.USER32(00000001), ref: 0046C6DD
    • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
    • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
    • CloseClipboard.USER32 ref: 0046C866
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
    • String ID: HH
    • API String ID: 589737431-2761332787
    • Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
    • Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
    • Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
    • Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA
    APIs
    • GetCursorPos.USER32(?), ref: 00456692
    • GetDesktopWindow.USER32 ref: 004566AA
    • GetWindowRect.USER32(00000000), ref: 004566B1
    • GetWindowLongW.USER32(?,000000F0), ref: 0045670D
    • GetWindowLongW.USER32(?,000000F0), ref: 00456720
    • DestroyWindow.USER32(?), ref: 00456731
    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
    • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
    • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
    • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
    • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
    • IsWindowVisible.USER32(?), ref: 00456812
    • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
    • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
    • GetWindowRect.USER32(?,?), ref: 0045685C
    • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
    • GetMonitorInfoW.USER32 ref: 00456894
    • CopyRect.USER32(?,?), ref: 004568A8
    • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
    • String ID: ($,$tooltips_class32
    • API String ID: 541082891-3320066284
    • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
    • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
    • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
    • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
    APIs
    • _wcslen.LIBCMT ref: 00454DCF
    • _wcslen.LIBCMT ref: 00454DE2
    • __wcsicoll.LIBCMT ref: 00454DEF
    • _wcslen.LIBCMT ref: 00454E04
    • __wcsicoll.LIBCMT ref: 00454E11
    • _wcslen.LIBCMT ref: 00454E24
    • __wcsicoll.LIBCMT ref: 00454E31
      • Part of subcall function 004115D0: __wcsicmp_l.LIBCMT ref: 00411657
    • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00454E65
    • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,?,?,?,?,?,00000000), ref: 00454E79
    • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454EB7
    • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00454EFB
    • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454F2C
    • FreeLibrary.KERNEL32(00000000), ref: 00454F37
    • ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 00454F94
    • DestroyIcon.USER32(?), ref: 00454FA2
    • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00454FC0
    • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00454FCC
    • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00454FF1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Load$Image_wcslen$__wcsicoll$IconLibraryMessageSend$DestroyExtractFreeMoveWindow__wcsicmp_l
    • String ID: .dll$.exe$.icl
    • API String ID: 2511167534-1154884017
    • Opcode ID: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
    • Instruction ID: 777b7c61fe84a0ac0f88e3bb9536c5d4e291b97e4b5026f6b39318954af55ba4
    • Opcode Fuzzy Hash: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
    • Instruction Fuzzy Hash: D461D9711043016AE620DF659D85F7B73ECEF84B0AF00481EFE81D5182E7B9A989C77A
    APIs
    • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00436B4E
    • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00436B73
    • _wcslen.LIBCMT ref: 00436B79
    • _wcscpy.LIBCMT ref: 00436B9F
    • _wcscat.LIBCMT ref: 00436BC0
    • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
    • _wcscat.LIBCMT ref: 00436C2A
    • _wcscat.LIBCMT ref: 00436C31
    • __wcsicoll.LIBCMT ref: 00436C4B
    • _wcsncpy.LIBCMT ref: 00436C62
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcscat$FileInfoVersion$QuerySizeValue__wcsicoll_wcscpy_wcslen_wcsncpy
    • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
    • API String ID: 1503153545-1459072770
    • Opcode ID: 1bca29e3adc21336a21f3c01565ed382529ec8d4b1eae201a388b16e544b708b
    • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
    • Opcode Fuzzy Hash: 1bca29e3adc21336a21f3c01565ed382529ec8d4b1eae201a388b16e544b708b
    • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
    APIs
      • Part of subcall function 004431E0: __time64.LIBCMT ref: 004431EA
    • _fseek.LIBCMT ref: 004527FC
    • __wsplitpath.LIBCMT ref: 0045285C
    • _wcscpy.LIBCMT ref: 00452871
    • _wcscat.LIBCMT ref: 00452886
    • __wsplitpath.LIBCMT ref: 004528B0
    • _wcscat.LIBCMT ref: 004528C8
    • _wcscat.LIBCMT ref: 004528DD
    • __fread_nolock.LIBCMT ref: 00452914
    • __fread_nolock.LIBCMT ref: 00452925
    • __fread_nolock.LIBCMT ref: 00452944
    • __fread_nolock.LIBCMT ref: 00452955
    • __fread_nolock.LIBCMT ref: 00452976
    • __fread_nolock.LIBCMT ref: 00452987
    • __fread_nolock.LIBCMT ref: 00452998
    • __fread_nolock.LIBCMT ref: 004529A9
      • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
      • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
      • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
      • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
      • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
      • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
      • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
    • __fread_nolock.LIBCMT ref: 00452A39
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
    • String ID:
    • API String ID: 2054058615-0
    • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
    • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
    • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
    • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID: 0
    • API String ID: 0-4108050209
    • Opcode ID: b9da739ef4394ef292cf8eb25369925a80ec30f337521dada9f854f90e9bbf21
    • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
    • Opcode Fuzzy Hash: b9da739ef4394ef292cf8eb25369925a80ec30f337521dada9f854f90e9bbf21
    • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
    APIs
      • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
    • GetWindowRect.USER32(?,?), ref: 004701EA
    • GetClientRect.USER32(?,?), ref: 004701FA
    • GetSystemMetrics.USER32(00000007), ref: 00470202
    • GetSystemMetrics.USER32(00000008), ref: 00470216
    • GetSystemMetrics.USER32(00000004), ref: 00470238
    • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0047026B
    • GetSystemMetrics.USER32(00000007), ref: 00470273
    • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004702A0
    • GetSystemMetrics.USER32(00000008), ref: 004702A8
    • GetSystemMetrics.USER32(00000004), ref: 004702CF
    • SetRect.USER32(?,00000000,00000000,?,?), ref: 004702F1
    • AdjustWindowRectEx.USER32(?,?,00000000,000000FF), ref: 00470304
    • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 0047033E
    • SetWindowLongW.USER32(00000000,000000EB,?), ref: 00470356
    • GetClientRect.USER32(?,?), ref: 00470371
    • GetStockObject.GDI32(00000011), ref: 00470391
    • SendMessageW.USER32(?,00000030,00000000), ref: 0047039D
    • SetTimer.USER32(00000000,00000000,00000028,Function_00061E7F), ref: 004703C4
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer_malloc
    • String ID: AutoIt v3 GUI
    • API String ID: 867697134-248962490
    • Opcode ID: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
    • Instruction ID: 96ed3905d942d8c5c267f8207effb08aff50268186fc7250a269a1908d1679c9
    • Opcode Fuzzy Hash: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
    • Instruction Fuzzy Hash: 27B19F71205301AFD324DF68DD45B6BB7E4FB88710F108A2EFA9587290DBB5E844CB5A
    APIs
    • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window
    • String ID: 0
    • API String ID: 2353593579-4108050209
    • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
    • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
    • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
    • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
    APIs
    • GetSysColor.USER32 ref: 0044A11D
    • GetClientRect.USER32(?,?), ref: 0044A18D
    • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
    • GetWindowDC.USER32(?), ref: 0044A1B3
    • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
    • ReleaseDC.USER32(?,00000000), ref: 0044A1D6
    • GetSysColor.USER32(0000000F), ref: 0044A1EC
    • GetWindowLongW.USER32(?,000000F0), ref: 0044A207
    • GetSysColor.USER32(0000000F), ref: 0044A216
    • GetSysColor.USER32(00000005), ref: 0044A21E
    • GetWindowDC.USER32 ref: 0044A277
    • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
    • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
    • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
    • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
    • ReleaseDC.USER32(?,00000000), ref: 0044A2D8
    • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
    • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
    • GetStockObject.GDI32(00000005), ref: 0044A312
    • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
    • String ID:
    • API String ID: 1744303182-0
    • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
    • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
    • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
    • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __wcsicoll$__wcsnicmp
    • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
    • API String ID: 790654849-1810252412
    • Opcode ID: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
    • Instruction ID: 1b62209f2aa4de5792947d5a3aa61dcd1c874d3672784017b8f4b2c72f71c34c
    • Opcode Fuzzy Hash: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
    • Instruction Fuzzy Hash: 7A3193B1644301A7CA00FA61DC83F5B73A85F54759F100A3FB955B61D6FA6CEA0C862F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID: >>>AUTOIT SCRIPT<<<$\
    • API String ID: 0-1896584978
    • Opcode ID: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
    • Instruction ID: e6fbcda15cb9520e0e34bfac0f9750edaedb1b44b840e2dcfb1a2c219c195b9a
    • Opcode Fuzzy Hash: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
    • Instruction Fuzzy Hash: 907186B2504300ABC720EB65C885FEBB3E8AF94714F148D1FF58997142E679E648C75A
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: InitVariant
    • String ID:
    • API String ID: 1927566239-0
    • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
    • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
    • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
    • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
    APIs
      • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
    • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
    • GetForegroundWindow.USER32 ref: 0046DBA4
    • IsWindow.USER32(?), ref: 0046DBDE
    • GetDesktopWindow.USER32 ref: 0046DCB5
    • EnumChildWindows.USER32(00000000), ref: 0046DCBC
    • EnumWindows.USER32(00460772,?), ref: 0046DCC4
      • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$EnumForegroundWindows_wcslen$ChildDesktop
    • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
    • API String ID: 1322021666-1919597938
    • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
    • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
    • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
    • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
    APIs
    • GetLocalTime.KERNEL32(?), ref: 0045DED4
    • SystemTimeToFileTime.KERNEL32(?,?), ref: 0045DEE4
    • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0045DEF0
    • _wcsncpy.LIBCMT ref: 0045DF0F
    • __wsplitpath.LIBCMT ref: 0045DF54
    • _wcscat.LIBCMT ref: 0045DF6C
    • _wcscat.LIBCMT ref: 0045DF7E
    • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0045DF93
    • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFA7
    • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFE5
    • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFFB
    • SetCurrentDirectoryW.KERNEL32(?), ref: 0045E00D
    • _wcscpy.LIBCMT ref: 0045E019
    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0045E05F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CurrentDirectory$Time$File$Local_wcscat$System__wsplitpath_wcscpy_wcsncpy
    • String ID: *.*
    • API String ID: 3201719729-438819550
    • Opcode ID: 89541da3f554ebb8d42e95f45bc66f31ca584aff69b040987f949bd9346ecb30
    • Instruction ID: 9ef8ac46b2ec3f8a2b66e183c5d6435db2730cdd54c1860218fefef83dfd89d7
    • Opcode Fuzzy Hash: 89541da3f554ebb8d42e95f45bc66f31ca584aff69b040987f949bd9346ecb30
    • Instruction Fuzzy Hash: D061A7B25043049BC724EF65C881E9FB3E8AF94704F048E1EF98987241DB79E949CB96
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __wcsicoll$IconLoad
    • String ID: blank$info$question$stop$warning
    • API String ID: 2485277191-404129466
    • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
    • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
    • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
    • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
    APIs
    • CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
    • GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
    • strncnt.LIBCMT ref: 00428646
    • strncnt.LIBCMT ref: 0042865A
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: strncnt$CompareErrorLastString
    • String ID:
    • API String ID: 1776594460-0
    • Opcode ID: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
    • Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
    • Opcode Fuzzy Hash: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
    • Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58
    APIs
    • LoadIconW.USER32(?,00000063), ref: 004545DA
    • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
    • SetWindowTextW.USER32(?,?), ref: 00454606
    • GetDlgItem.USER32(?,000003EA), ref: 0045461F
    • SetWindowTextW.USER32(00000000,?), ref: 00454626
    • GetDlgItem.USER32(?,000003E9), ref: 00454637
    • SetWindowTextW.USER32(00000000,?), ref: 0045463E
    • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
    • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
    • GetWindowRect.USER32(?,?), ref: 00454688
    • SetWindowTextW.USER32(?,?), ref: 004546FD
    • GetDesktopWindow.USER32 ref: 00454708
    • GetWindowRect.USER32(00000000), ref: 0045470F
    • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
    • GetClientRect.USER32(?,?), ref: 0045476F
    • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
    • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
    • String ID:
    • API String ID: 3869813825-0
    • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
    • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
    • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
    • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
    APIs
    • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
    • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
    • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
    • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
    • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
    • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
    • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
    • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
    • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
    • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
    • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
    • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
    • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
    • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
    • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
    • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
    • GetCursorInfo.USER32 ref: 00458E03
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Cursor$Load$Info
    • String ID:
    • API String ID: 2577412497-0
    • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
    • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
    • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
    • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
    APIs
    • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
    • GetFocus.USER32 ref: 004696E0
    • GetDlgCtrlID.USER32(00000000), ref: 004696EB
    • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessagePost$CtrlFocus
    • String ID: 0
    • API String ID: 1534620443-4108050209
    • Opcode ID: a7e7dd4ad94bd17b8779821b2562c3e74f4a4d43059232d4a161c8df91f382bc
    • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
    • Opcode Fuzzy Hash: a7e7dd4ad94bd17b8779821b2562c3e74f4a4d43059232d4a161c8df91f382bc
    • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
    APIs
    • _memset.LIBCMT ref: 00468107
    • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
    • GetMenuItemCount.USER32(?), ref: 00468227
    • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
    • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
    • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
    • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
    • GetMenuItemCount.USER32 ref: 004682DC
    • SetMenuItemInfoW.USER32 ref: 00468317
    • GetCursorPos.USER32(00000000), ref: 00468322
    • SetForegroundWindow.USER32(?), ref: 0046832D
    • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
    • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
    • String ID: 0
    • API String ID: 3993528054-4108050209
    • Opcode ID: 96134d5ccf85dd2c353584f61e992c1258bc53944db1005dc2f45aa542165571
    • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
    • Opcode Fuzzy Hash: 96134d5ccf85dd2c353584f61e992c1258bc53944db1005dc2f45aa542165571
    • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
    APIs
    • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
      • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
      • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
      • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
    • SendMessageW.USER32(?), ref: 0046F34C
    • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
    • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
    • _wcscat.LIBCMT ref: 0046F3BC
    • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
    • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
    • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
    • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
    • DragFinish.SHELL32(?), ref: 0046F414
    • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow_wcscat
    • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
    • API String ID: 4085615965-3440237614
    • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
    • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
    • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
    • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __wcsicoll
    • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
    • API String ID: 3832890014-4202584635
    • Opcode ID: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
    • Instruction ID: bf73cd225697d97a5a257e466bf5c8c79b4efa22739c650e03c6b1f9c6e9338c
    • Opcode Fuzzy Hash: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
    • Instruction Fuzzy Hash: 1D01616160562122FE11322A7C03BDF15898F5139AF14447BFC05F1282FF4DDA8692EE
    APIs
    • _memset.LIBCMT ref: 004669C4
    • _wcsncpy.LIBCMT ref: 00466A21
    • _wcsncpy.LIBCMT ref: 00466A4D
      • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
      • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
    • _wcstok.LIBCMT ref: 00466A90
      • Part of subcall function 004142A3: __getptd.LIBCMT ref: 004142A9
    • _wcstok.LIBCMT ref: 00466B3F
    • _wcscpy.LIBCMT ref: 00466BC8
    • GetOpenFileNameW.COMDLG32(00000058), ref: 00466CFE
    • _wcslen.LIBCMT ref: 00466D1D
    • _memset.LIBCMT ref: 00466BEE
      • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
    • _wcslen.LIBCMT ref: 00466D4B
    • GetSaveFileNameW.COMDLG32(00000058), ref: 00466D9E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcslen$FileName_memset_wcscpy_wcsncpy_wcstok$OpenSave__getptd
    • String ID: X$HH
    • API String ID: 3021350936-1944015008
    • Opcode ID: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
    • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
    • Opcode Fuzzy Hash: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
    • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
    APIs
    • _memset.LIBCMT ref: 0045F4AE
    • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
    • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
    • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: InfoItemMenu$Sleep_memset
    • String ID: 0
    • API String ID: 1504565804-4108050209
    • Opcode ID: d1fae1760d081b6b8cddc0049297ea6fd0734e9abca2e90a1ac85592b3d85e38
    • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
    • Opcode Fuzzy Hash: d1fae1760d081b6b8cddc0049297ea6fd0734e9abca2e90a1ac85592b3d85e38
    • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
    APIs
    • DestroyWindow.USER32(?,004A83D8,?), ref: 00455800
    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$CreateDestroy
    • String ID: ,$tooltips_class32
    • API String ID: 1109047481-3856767331
    • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
    • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
    • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
    • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
    APIs
    • _wcsncpy.LIBCMT ref: 0045CCFA
    • __wsplitpath.LIBCMT ref: 0045CD3C
    • _wcscat.LIBCMT ref: 0045CD51
    • _wcscat.LIBCMT ref: 0045CD63
    • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
      • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
    • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
    • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
    • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
    • _wcscpy.LIBCMT ref: 0045CE14
    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
    • String ID: *.*
    • API String ID: 1153243558-438819550
    • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
    • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
    • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
    • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
    APIs
    • _memset.LIBCMT ref: 00455127
    • GetMenuItemInfoW.USER32 ref: 00455146
    • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
    • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
    • GetMenuItemCount.USER32(?), ref: 004551D9
    • SetMenu.USER32(?,00000000), ref: 004551E7
    • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
    • DrawMenuBar.USER32 ref: 00455207
    • DeleteObject.GDI32(?), ref: 0045564E
    • DeleteObject.GDI32(?), ref: 0045565C
    • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow_memset
    • String ID: 0
    • API String ID: 1663942905-4108050209
    • Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
    • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
    • Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
    • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __get_daylight__invoke_watson$__gmtime64_s$__getptd_noexit
    • String ID:
    • API String ID: 1481289235-0
    • Opcode ID: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
    • Instruction ID: 11750150b5911b8a2d77b888e51b7102539fbc40f42687a9f62e69b5342e6946
    • Opcode Fuzzy Hash: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
    • Instruction Fuzzy Hash: 8461B372B00B15DBD724AB69DC81AEB73E99F84324F14452FF011D7682EB78DA808B58
    APIs
    • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
    • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
    • SendMessageW.USER32 ref: 0046FBAF
    • SendMessageW.USER32 ref: 0046FBE2
    • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001), ref: 0046FC1B
    • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
    • ImageList_Create.COMCTL32(00000020,00000020,00000021,?,00000001), ref: 0046FC51
    • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
    • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FC97
    • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FCA5
    • SendMessageW.USER32 ref: 0046FD00
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$IconImageList_$CreateExtractReplace
    • String ID:
    • API String ID: 2632138820-0
    • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
    • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
    • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
    • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
    APIs
    • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
    • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
    • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
    • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
    • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
    • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
    • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
    • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
    • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
    • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
    • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
    • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
    • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
    • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
    • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CursorLoad
    • String ID:
    • API String ID: 3238433803-0
    • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
    • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
    • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
    • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
    APIs
    • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
    • _wcslen.LIBCMT ref: 00460B00
    • __swprintf.LIBCMT ref: 00460B9E
    • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
    • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
    • GetDlgCtrlID.USER32(?), ref: 00460CE6
    • GetWindowRect.USER32(?,?), ref: 00460D21
    • GetParent.USER32(?), ref: 00460D40
    • ScreenToClient.USER32(00000000), ref: 00460D47
    • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
    • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
    • String ID: %s%u
    • API String ID: 1899580136-679674701
    • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
    • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
    • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
    • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
    APIs
    • CoTaskMemFree.OLE32(?), ref: 0047D6D3
      • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
    • StringFromCLSID.OLE32(?,?), ref: 0047D6B5
      • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
      • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
    • StringFromIID.OLE32(?,?), ref: 0047D7F0
    • CoTaskMemFree.OLE32(?), ref: 0047D80A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: FreeFromStringTask_wcslen$_wcscpy
    • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
    • API String ID: 2485709727-934586222
    • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
    • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
    • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
    • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcscpy$Folder_memset$BrowseDesktopFromInitializeListMallocPathUninitialize
    • String ID: HH
    • API String ID: 3381189665-2761332787
    • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
    • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
    • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
    • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
    APIs
    • GetDC.USER32(00000000), ref: 00434585
    • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
    • CreateCompatibleDC.GDI32(00000000), ref: 0043459B
    • SelectObject.GDI32(00000000,?), ref: 004345A9
    • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
    • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
    • String ID: (
    • API String ID: 3300687185-3887548279
    • Opcode ID: 440148b18d84eb95ba181de3259d53385060cfec68f9b8a73670629712acb2fa
    • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
    • Opcode Fuzzy Hash: 440148b18d84eb95ba181de3259d53385060cfec68f9b8a73670629712acb2fa
    • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
    APIs
    • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
    • __swprintf.LIBCMT ref: 0045E4D9
    • _printf.LIBCMT ref: 0045E595
    • _printf.LIBCMT ref: 0045E5B7
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: LoadString_printf$__swprintf_wcslen
    • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
    • API String ID: 3590180749-2894483878
    • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
    • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
    • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
    • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
    APIs
    • GetWindowLongW.USER32(?,000000F0), ref: 0046F911
    • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
    • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
    • DeleteObject.GDI32(?), ref: 0046F950
    • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,00000000,00000000,00000000,00002010,?,000000F0), ref: 0046F95E
    • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
    • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
    • DeleteObject.GDI32(?), ref: 0046F9CF
    • DestroyIcon.USER32(?,?,000000F7,00000001,00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9DD
    • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
    • DestroyIcon.USER32(?), ref: 0046FA4F
    • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
    • DeleteObject.GDI32(?), ref: 0046FA68
    • DestroyIcon.USER32(?,?,000000F7,00000001,?), ref: 0046FA76
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Icon$Destroy$DeleteMessageObjectSend$ImageLoad$ExtractLongWindow
    • String ID:
    • API String ID: 3412594756-0
    • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
    • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
    • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
    • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
    APIs
      • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
      • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
    • GetDriveTypeW.KERNEL32 ref: 0045DA30
    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
      • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: SendString$_wcslen$BuffCharDriveLowerType
    • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
    • API String ID: 4013263488-4113822522
    • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
    • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
    • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
    • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcslen$_wcsncpy$LocalTime__wcstoi64
    • String ID:
    • API String ID: 228034949-0
    • Opcode ID: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
    • Instruction ID: c9113392db11e6d0b84b7dcaf0f9983ae7bcdcfbf3325debe08446cd55f13bc3
    • Opcode Fuzzy Hash: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
    • Instruction Fuzzy Hash: 874194B181435066DA10FF6AC8479DFB3A8EF89314F84495FF945D3162E378E64883AA
    APIs
    • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
    • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
    • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
    • GlobalLock.KERNEL32(00000000), ref: 00433523
    • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
    • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
    • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
    • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
    • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
    • GlobalFree.KERNEL32(00000000), ref: 0043357B
    • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
    • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
    • DeleteObject.GDI32(?), ref: 00433603
    • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
    • String ID:
    • API String ID: 3969911579-0
    • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
    • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
    • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
    • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
    APIs
    • GetParent.USER32 ref: 00445A8D
    • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
    • __wcsicoll.LIBCMT ref: 00445AC4
    • __wcsicoll.LIBCMT ref: 00445AE0
    • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __wcsicoll$ClassMessageNameParentSend
    • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
    • API String ID: 3125838495-3381328864
    • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
    • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
    • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
    • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CopyVariant$ErrorLast
    • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
    • API String ID: 2286883814-4206948668
    • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
    • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
    • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
    • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
    APIs
      • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
      • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
    • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
    • _wcscpy.LIBCMT ref: 00475F18
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: BuffCharDriveLowerType_wcscpy_wcslen
    • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
    • API String ID: 3052893215-4176887700
    • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
    • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
    • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
    • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
    APIs
    • StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5
      • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
      • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
      • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
    • CoTaskMemFree.OLE32(?,00000000), ref: 00458335
    • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
    • RegQueryValueExW.ADVAPI32 ref: 00458381
    • CLSIDFromString.OLE32(00000000,?), ref: 004583AF
    • RegQueryValueExW.ADVAPI32 ref: 004583E8
    • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
      • Part of subcall function 00413F97: __wtof_l.LIBCMT ref: 00413FA1
    • RegCloseKey.ADVAPI32(?), ref: 004584BA
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: FromQueryStringValue_wcslen$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
    • String ID: Version$\TypeLib$interface\
    • API String ID: 656856066-939221531
    • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
    • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
    • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
    • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
    APIs
    • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
    • __swprintf.LIBCMT ref: 0045E6EE
    • _printf.LIBCMT ref: 0045E7A9
    • _printf.LIBCMT ref: 0045E7D2
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: LoadString_printf$__swprintf_wcslen
    • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
    • API String ID: 3590180749-2354261254
    • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
    • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
    • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
    • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
    APIs
      • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
    • _memset.LIBCMT ref: 00458194
    • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
    • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
    • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
    • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
    • CLSIDFromString.OLE32(00000000,?), ref: 00458279
    • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
    • RegCloseKey.ADVAPI32(00000000), ref: 00458296
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset_wcslen
    • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
    • API String ID: 2255324689-22481851
    • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
    • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
    • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
    • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
    APIs
    • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
    • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
    • RegCloseKey.ADVAPI32(?), ref: 00458615
      • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
    • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
    • __wcsicoll.LIBCMT ref: 004585D6
    • IIDFromString.OLE32(?,?,?,?), ref: 004585EB
    • RegCloseKey.ADVAPI32(?), ref: 004585F8
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CloseOpen$EnumFromQueryStringValue__wcsicoll_wcslen
    • String ID: ($interface$interface\
    • API String ID: 2231185022-3327702407
    • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
    • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
    • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
    • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
    APIs
    • WSAStartup.WSOCK32(00000101,?), ref: 004365A5
    • gethostname.WSOCK32(00000100,00000100,00000101,?), ref: 004365BC
    • gethostbyname.WSOCK32(00000101,00000100,00000100,00000101,?), ref: 004365C6
    • _wcscpy.LIBCMT ref: 004365F5
    • WSACleanup.WSOCK32 ref: 004365FD
    • inet_ntoa.WSOCK32(00000100,?), ref: 00436624
    • _strcat.LIBCMT ref: 0043662F
    • _wcscpy.LIBCMT ref: 00436644
    • WSACleanup.WSOCK32(?,?,?,?,?,?,00000100,?), ref: 00436652
    • _wcscpy.LIBCMT ref: 00436666
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcscpy$Cleanup$Startup_strcatgethostbynamegethostnameinet_ntoa
    • String ID: 0.0.0.0
    • API String ID: 2691793716-3771769585
    • Opcode ID: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
    • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
    • Opcode Fuzzy Hash: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
    • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
    APIs
    • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
    • __crt_waiting_on_module_handle.LIBCMT ref: 00416B2F
      • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
      • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
    • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
    • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
    • __lock.LIBCMT ref: 00416B8A
    • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
    • __lock.LIBCMT ref: 00416BAB
    • ___addlocaleref.LIBCMT ref: 00416BC9
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
    • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
    • API String ID: 1028249917-2843748187
    • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
    • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
    • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
    • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
    APIs
    • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
    • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
    • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
    • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
    • SendMessageW.USER32(?,00000402,?), ref: 0044941C
    • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
    • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$CharNext
    • String ID:
    • API String ID: 1350042424-0
    • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
    • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
    • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
    • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
    APIs
    • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
    • SetKeyboardState.USER32(?), ref: 00453C5A
    • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
    • GetKeyState.USER32(000000A0), ref: 00453C99
    • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
    • GetKeyState.USER32(000000A1), ref: 00453CDA
    • GetAsyncKeyState.USER32(00000011), ref: 00453D07
    • GetKeyState.USER32(00000011), ref: 00453D15
    • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
    • GetKeyState.USER32(00000012), ref: 00453D4D
    • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
    • GetKeyState.USER32(0000005B), ref: 00453D85
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: State$Async$Keyboard
    • String ID:
    • API String ID: 541375521-0
    • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
    • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
    • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
    • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
    APIs
    • GetDlgItem.USER32(?,00000001), ref: 00437DD7
    • GetWindowRect.USER32(00000000,?), ref: 00437DE9
    • MoveWindow.USER32(00000000,0000000A,?,?,?,00000000), ref: 00437E5C
    • GetDlgItem.USER32(?,00000002), ref: 00437E70
    • GetWindowRect.USER32(00000000,?), ref: 00437E82
    • MoveWindow.USER32(00000000,?,00000000,?,?,00000000), ref: 00437EDB
    • GetDlgItem.USER32(?,000003E9), ref: 00437EEA
    • GetWindowRect.USER32(00000000,?), ref: 00437EFC
    • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00437F46
    • GetDlgItem.USER32(?,000003EA), ref: 00437F55
    • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 00437F6E
    • InvalidateRect.USER32(?,00000000,00000001), ref: 00437F78
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$ItemMoveRect$Invalidate
    • String ID:
    • API String ID: 3096461208-0
    • Opcode ID: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
    • Instruction ID: 6334a21bf5495bf578199e0a0c43900503e40640961724061e29feeedb49a886
    • Opcode Fuzzy Hash: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
    • Instruction Fuzzy Hash: 46511CB16083069FC318DF68DD85A2BB7E9ABC8300F144A2DF985D3391E6B4ED058B95
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
    • String ID:
    • API String ID: 136442275-0
    • Opcode ID: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
    • Instruction ID: e47e2093bf76b35e8f1fec89578fc46911e8a4506192668d3a16ce6d5165f020
    • Opcode Fuzzy Hash: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
    • Instruction Fuzzy Hash: 744124B2408345ABC235E754C885EEF73ECABD8314F44891EB68D42141EB796688C7A7
    APIs
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ConnectRegistry_wcslen
    • String ID: HH
    • API String ID: 535477410-2761332787
    • Opcode ID: cc03a81e182be6ba1e7ee8022fe76587c4fcfc5607386b983ff95d826003d501
    • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
    • Opcode Fuzzy Hash: cc03a81e182be6ba1e7ee8022fe76587c4fcfc5607386b983ff95d826003d501
    • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
    APIs
    • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
    • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
    • _wcslen.LIBCMT ref: 00460502
    • CharUpperBuffW.USER32(?,00000000), ref: 00460510
    • GetClassNameW.USER32(?,?,00000400), ref: 00460589
    • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
    • GetClassNameW.USER32(?,?,00000400), ref: 00460606
    • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
    • GetWindowRect.USER32(?,?), ref: 004606AD
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen
    • String ID: ThumbnailClass
    • API String ID: 4123061591-1241985126
    • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
    • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
    • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
    • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
    APIs
      • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
      • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
      • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
      • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
    • DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
    • ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
    • ImageList_EndDrag.COMCTL32 ref: 0046F583
    • ReleaseCapture.USER32 ref: 0046F589
    • SetWindowTextW.USER32(?,00000000), ref: 0046F620
    • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
    • String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
    • API String ID: 2483343779-2060113733
    • Opcode ID: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
    • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
    • Opcode Fuzzy Hash: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
    • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
    APIs
    • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,004A83D8,?), ref: 0046FDF0
    • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
    • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,004A83D8,?), ref: 0046FE20
    • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
    • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
    • GetClientRect.USER32(?,?), ref: 0046FEF2
    • RedrawWindow.USER32(?,?,00000000,00000000), ref: 0046FF02
    • DestroyIcon.USER32(?), ref: 0046FFCC
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
    • String ID: 2
    • API String ID: 1331449709-450215437
    • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
    • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
    • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
    • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
    APIs
    • DestroyWindow.USER32(?,?,?,?,?,?,00000000,static,00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 00450EE1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: DestroyWindow
    • String ID: static
    • API String ID: 3375834691-2160076837
    • Opcode ID: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
    • Instruction ID: 4605c95b1b006c90d65e271c0fdf07f62d21d56273c2870bf7f2e3decf5281c5
    • Opcode Fuzzy Hash: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
    • Instruction Fuzzy Hash: 4531B572200300BBD7109B64DC45F6BB3A8EBC9711F204A2EFA50D72C0D7B4E8048B69
    APIs
    • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
    • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
    • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
    • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
    • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
    • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
    • _memcmp.LIBCMT ref: 004394A9
    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
    Strings
    • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
    • SeIncreaseQuotaPrivilege, xrefs: 0043946A
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread_memcmp
    • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
    • API String ID: 1446985595-805462909
    • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
    • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
    • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
    • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
    APIs
    • SetErrorMode.KERNEL32(00000001), ref: 0045D848
    • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
    • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ErrorMode$DriveType
    • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
    • API String ID: 2907320926-41864084
    • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
    • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
    • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
    • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
    APIs
    • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
    • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
    • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
    • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
    • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
    • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
    • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
    • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
    • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
      • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
      • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
      • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
    • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
    • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
      • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ArraySafe$Data$AccessUnaccess$Exception@8ThrowVartype_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
    • String ID:
    • API String ID: 1932665248-0
    • Opcode ID: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
    • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
    • Opcode Fuzzy Hash: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
    • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
    APIs
    • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
    • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
    • GetWindowLongW.USER32(?,000000F0), ref: 004481A7
    • _memset.LIBCMT ref: 004481BA
    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
    • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
    • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
    • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
    • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
    • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
    • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$LongWindow_memset
    • String ID:
    • API String ID: 830647256-0
    • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
    • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
    • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
    • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
    APIs
      • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
    • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
    • ImageList_Destroy.COMCTL32(?), ref: 0046EB04
    • ImageList_Destroy.COMCTL32(?), ref: 0046EB18
    • ImageList_Destroy.COMCTL32(?), ref: 0046EB24
    • DeleteObject.GDI32(003A0000), ref: 0046EB4F
    • DestroyIcon.USER32(0057005C), ref: 0046EB67
    • DeleteObject.GDI32(BFCC8498), ref: 0046EB7F
    • DestroyWindow.USER32(00730079), ref: 0046EB97
    • DestroyIcon.USER32(?), ref: 0046EBBF
    • DestroyIcon.USER32(?), ref: 0046EBCD
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateRectTableWindow
    • String ID:
    • API String ID: 802431696-0
    • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
    • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
    • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
    • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
    APIs
    • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
    • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
    • GetKeyState.USER32(000000A0), ref: 00444E26
    • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
    • GetKeyState.USER32(000000A1), ref: 00444E51
    • GetAsyncKeyState.USER32(00000011), ref: 00444E69
    • GetKeyState.USER32(00000011), ref: 00444E77
    • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
    • GetKeyState.USER32(00000012), ref: 00444E9D
    • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
    • GetKeyState.USER32(0000005B), ref: 00444EC3
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: State$Async$Keyboard
    • String ID:
    • API String ID: 541375521-0
    • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
    • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
    • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
    • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID: HH
    • API String ID: 0-2761332787
    • Opcode ID: 42510643c9cdba6d1e7b7cb61b235febd1ff76eef9dce87624ca7f12cd0f3b2e
    • Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
    • Opcode Fuzzy Hash: 42510643c9cdba6d1e7b7cb61b235febd1ff76eef9dce87624ca7f12cd0f3b2e
    • Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A
    APIs
    • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
    • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
    • _wcslen.LIBCMT ref: 00450944
    • _wcscat.LIBCMT ref: 00450955
    • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
    • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$Window_wcscat_wcslen
    • String ID: -----$SysListView32
    • API String ID: 4008455318-3975388722
    • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
    • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
    • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
    • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
    APIs
    • _memset.LIBCMT ref: 00448625
    • CreateMenu.USER32 ref: 0044863C
    • SetMenu.USER32(?,00000000), ref: 0044864C
    • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
    • IsMenu.USER32(?), ref: 004486EB
    • CreatePopupMenu.USER32 ref: 004486F5
    • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
    • DrawMenuBar.USER32 ref: 00448742
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
    • String ID: 0
    • API String ID: 176399719-4108050209
    • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
    • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
    • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
    • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
    APIs
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
    • GetDlgCtrlID.USER32(00000000), ref: 00469289
    • GetParent.USER32 ref: 004692A4
    • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
    • GetDlgCtrlID.USER32(00000000), ref: 004692AE
    • GetParent.USER32 ref: 004692C7
    • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$CtrlParent$_wcslen
    • String ID: ComboBox$ListBox
    • API String ID: 2040099840-1403004172
    • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
    • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
    • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
    • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
    APIs
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
    • GetDlgCtrlID.USER32(00000000), ref: 00469483
    • GetParent.USER32 ref: 0046949E
    • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
    • GetDlgCtrlID.USER32(00000000), ref: 004694A8
    • GetParent.USER32 ref: 004694C1
    • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$CtrlParent$_wcslen
    • String ID: ComboBox$ListBox
    • API String ID: 2040099840-1403004172
    • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
    • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
    • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
    • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
    APIs
      • Part of subcall function 004419ED: DeleteObject.GDI32(?), ref: 00441A53
    • SendMessageW.USER32(75A523D0,00001001,00000000,00000000), ref: 00448E73
    • SendMessageW.USER32(75A523D0,00001026,00000000,00000000), ref: 00448E7E
      • Part of subcall function 00441A7A: CreateSolidBrush.GDI32 ref: 00441ACB
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$BrushCreateDeleteObjectSolid
    • String ID:
    • API String ID: 3771399671-0
    • Opcode ID: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
    • Instruction ID: ebbecaf0548398ae771b9aa28ebf0b72f134f9ffbbfb28b2279bd799396bd9e3
    • Opcode Fuzzy Hash: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
    • Instruction Fuzzy Hash: F4510930208300AFE2209F25DD85F6F77EAEB85B14F14091EF994E72D0CBB9E9458769
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: InitVariant$_malloc_wcscpy_wcslen
    • String ID:
    • API String ID: 3413494760-0
    • Opcode ID: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
    • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
    • Opcode Fuzzy Hash: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
    • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
    APIs
    • GetCurrentThreadId.KERNEL32 ref: 004377D7
    • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
    • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
    • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
    • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
    • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
    • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Thread$AttachInput$Window$Process$CurrentForeground
    • String ID:
    • API String ID: 2156557900-0
    • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
    • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
    • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
    • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __wcsicoll
    • String ID: 0%d$DOWN$OFF
    • API String ID: 3832890014-468733193
    • Opcode ID: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
    • Instruction ID: 3901981f80fa7430cd77b89167089bc3925961a07aad88d0cc2f25a35af8916b
    • Opcode Fuzzy Hash: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
    • Instruction Fuzzy Hash: B7F1D8614083856DEB21EB21C845BAF7BE85F95309F08092FF98212193D7BCD68DC76B
    APIs
    • VariantInit.OLEAUT32(00000000), ref: 0045E959
    • VariantCopy.OLEAUT32(00000000), ref: 0045E963
    • VariantClear.OLEAUT32 ref: 0045E970
    • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
    • __swprintf.LIBCMT ref: 0045EB1F
    • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
    • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
    Strings
    • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Variant$InitTime$ClearCopyFromSystem__swprintf
    • String ID: %4d%02d%02d%02d%02d%02d
    • API String ID: 43541914-1568723262
    • Opcode ID: 14db4cabc5e1b0f67770c810f21e70b33e6c91423244c68acaef5aa9588cc2da
    • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
    • Opcode Fuzzy Hash: 14db4cabc5e1b0f67770c810f21e70b33e6c91423244c68acaef5aa9588cc2da
    • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
    APIs
    • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FE66
    • Sleep.KERNEL32(0000000A), ref: 0042FE6E
    • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FF5D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: DecrementInterlocked$Sleep
    • String ID: 0vH$0vH$4RH0vH$@COM_EVENTOBJ
    • API String ID: 2250217261-3412429629
    • Opcode ID: 8ee3dc3b90658de1bdba7935e7c509bae4c97cbbd898303c1487c3161a53cb39
    • Instruction ID: 990b5f35a06538e4ae7b6c94f393f4a5fafaaf51bfa382c75dcb300f2d234fa3
    • Opcode Fuzzy Hash: 8ee3dc3b90658de1bdba7935e7c509bae4c97cbbd898303c1487c3161a53cb39
    • Instruction Fuzzy Hash: E0B1C0715083009FC714EF54C990A5FB3E4AF98304F508A2FF495972A2DB78ED4ACB9A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
    • API String ID: 0-1603158881
    • Opcode ID: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
    • Instruction ID: 1d39c91c6ba170ccd8bd44326015c92659356e06a413e753493f98454e3169a0
    • Opcode Fuzzy Hash: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
    • Instruction Fuzzy Hash: 49A1D3B14043459BCB20EF50CC81BDE37A4AF94348F44891FF9896B182EF79A64DC76A
    APIs
    • _memset.LIBCMT ref: 00479D1F
    • VariantInit.OLEAUT32(?), ref: 00479F06
    • VariantClear.OLEAUT32(?), ref: 00479F11
    • VariantInit.OLEAUT32(?), ref: 00479DF7
      • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
      • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
      • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
    • VariantClear.OLEAUT32(?), ref: 00479F9C
      • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
      • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
      • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
      • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Variant$Copy$ClearInit$ErrorLast_memset
    • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
    • API String ID: 665237470-60002521
    • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
    • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
    • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
    • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
    APIs
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ConnectRegistry_wcslen
    • String ID: HH
    • API String ID: 535477410-2761332787
    • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
    • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
    • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
    • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
    APIs
    • _memset.LIBCMT ref: 0045F317
    • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
    • IsMenu.USER32(?), ref: 0045F380
    • CreatePopupMenu.USER32 ref: 0045F3C5
    • GetMenuItemCount.USER32(?), ref: 0045F42F
    • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
    • String ID: 0$2
    • API String ID: 3311875123-3793063076
    • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
    • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
    • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
    • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
    APIs
    • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe), ref: 0043719E
    • LoadStringW.USER32(00000000), ref: 004371A7
    • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
    • LoadStringW.USER32(00000000), ref: 004371C0
    • _printf.LIBCMT ref: 004371EC
    • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
    Strings
    • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
    • C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe, xrefs: 00437189
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: HandleLoadModuleString$Message_printf
    • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe
    • API String ID: 220974073-3545422949
    • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
    • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
    • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
    • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
    • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
    • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
    • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
    APIs
      • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,?,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,004A8E80,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,0040F3D2), ref: 0040FFCA
      • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
    • lstrcmpiW.KERNEL32(?,?), ref: 0045355E
    • MoveFileW.KERNEL32(?,?), ref: 0045358E
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: File$AttributesFullMoveNamePathlstrcmpi
    • String ID:
    • API String ID: 978794511-0
    • Opcode ID: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
    • Instruction ID: dcad70f49e32ae1adaf0c812d378eb0bba467e0a617048934f4a65f03e3a0b24
    • Opcode Fuzzy Hash: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
    • Instruction Fuzzy Hash: 665162B25043406AC724EF61D885ADFB3E8AFC8305F44992EB94992151E73DD34DC767
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
    • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
    • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
    • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
    APIs
      • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
      • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
      • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
    • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
    • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
    • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
    • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
    • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
    • Sleep.KERNEL32(00000000), ref: 00445D70
    • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
    • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
    • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
    • String ID:
    • API String ID: 2014098862-0
    • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
    • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
    • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
    • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AddressProc_malloc$_strcat_strlen
    • String ID: AU3_FreeVar
    • API String ID: 2184576858-771828931
    • Opcode ID: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
    • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
    • Opcode Fuzzy Hash: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
    • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
    APIs
    • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
    • DestroyWindow.USER32(?), ref: 0042A751
    • UnregisterHotKey.USER32(?), ref: 0042A778
    • FreeLibrary.KERNEL32(?), ref: 0042A822
    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
    • String ID: close all
    • API String ID: 4174999648-3243417748
    • Opcode ID: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
    • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
    • Opcode Fuzzy Hash: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
    • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
    APIs
    • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
    • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
    • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
    • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
    • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
    • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
      • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
    • String ID:
    • API String ID: 1291720006-3916222277
    • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
    • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
    • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
    • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ErrorLastselect
    • String ID: HH
    • API String ID: 215497628-2761332787
    • Opcode ID: 81123ba87c51c271d749794d4387e1d0575ba96382d8685f9443cecf8545e782
    • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
    • Opcode Fuzzy Hash: 81123ba87c51c271d749794d4387e1d0575ba96382d8685f9443cecf8545e782
    • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __snwprintf__wcsicoll_wcscpy
    • String ID: , $$0vH$AUTOITCALLVARIABLE%d$CALLARGARRAY
    • API String ID: 1729044348-3708979750
    • Opcode ID: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
    • Instruction ID: 823d0c4529048d9f890bbf28e75db1a658c609af9319d28fcdda535ef0d13f31
    • Opcode Fuzzy Hash: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
    • Instruction Fuzzy Hash: E651A571514300ABD610EF65C882ADFB3A4EFC4348F048D2FF54967291D779E949CBAA
    APIs
      • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,?,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,004A8E80,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,0040F3D2), ref: 0040FFCA
    • lstrcmpiW.KERNEL32(?,?), ref: 0044BC04
    • MoveFileW.KERNEL32(?,?), ref: 0044BC38
    • _wcscat.LIBCMT ref: 0044BCAA
    • _wcslen.LIBCMT ref: 0044BCB7
    • _wcslen.LIBCMT ref: 0044BCCB
    • SHFileOperationW.SHELL32 ref: 0044BD16
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
    • String ID: \*.*
    • API String ID: 2326526234-1173974218
    • Opcode ID: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
    • Instruction ID: 9e4979448571685848097db6772507fbfe8bfb8d1337cd0032b1ea927bdad9db
    • Opcode Fuzzy Hash: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
    • Instruction Fuzzy Hash: 4B3183B14083019AD724EF21C5D5ADFB3E4EFC8304F444D6EB98993251EB39E608D7AA
    APIs
      • Part of subcall function 00436328: _wcsncpy.LIBCMT ref: 0043633C
    • _wcslen.LIBCMT ref: 004366DD
    • GetFileAttributesW.KERNEL32(?), ref: 00436700
    • GetLastError.KERNEL32 ref: 0043670F
    • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
    • _wcsrchr.LIBCMT ref: 0043674C
      • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
    • String ID: \
    • API String ID: 321622961-2967466578
    • Opcode ID: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
    • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
    • Opcode Fuzzy Hash: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
    • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __wcsnicmp
    • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
    • API String ID: 1038674560-2734436370
    • Opcode ID: dc7e98e38d8725b7134af3b864f32bf76aed1b78794146943df9d66deb8fb3e7
    • Instruction ID: f72ce1d64a5a3b865947b719243e4701f1ba8c8209579f194a7ae3ad15c73224
    • Opcode Fuzzy Hash: dc7e98e38d8725b7134af3b864f32bf76aed1b78794146943df9d66deb8fb3e7
    • Instruction Fuzzy Hash: 1B21F87261161067E730B659DCC2BDB63985F65305F04406BF800AA247D6ADA98A83AA
    APIs
    • DeleteObject.GDI32(?), ref: 0044157D
    • GetDC.USER32(00000000), ref: 00441585
    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
    • ReleaseDC.USER32(00000000,00000000), ref: 0044159B
    • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
    • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
    • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
    • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
    • String ID:
    • API String ID: 3864802216-0
    • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
    • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
    • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
    • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
    APIs
    • _memset.LIBCMT ref: 00401257
      • Part of subcall function 00401BE0: _memset.LIBCMT ref: 00401C62
      • Part of subcall function 00401BE0: _wcsncpy.LIBCMT ref: 00401CA1
      • Part of subcall function 00401BE0: _wcscpy.LIBCMT ref: 00401CBD
      • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
    • KillTimer.USER32(?,?), ref: 004012B0
    • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
    • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
    • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
    • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
    • String ID:
    • API String ID: 1792922140-0
    • Opcode ID: 91f47cbc1f218a7f09512ea68bd6b482f011e20e77652f43937312b7b91c0350
    • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
    • Opcode Fuzzy Hash: 91f47cbc1f218a7f09512ea68bd6b482f011e20e77652f43937312b7b91c0350
    • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB
    APIs
    • ___set_flsgetvalue.LIBCMT ref: 004140E1
      • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
      • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
      • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
    • ___fls_getvalue@4.LIBCMT ref: 004140EC
      • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
    • ___fls_setvalue@8.LIBCMT ref: 004140FF
      • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
    • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
    • ExitThread.KERNEL32 ref: 0041410F
    • GetCurrentThreadId.KERNEL32 ref: 00414115
    • __freefls@4.LIBCMT ref: 00414135
    • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
    • String ID:
    • API String ID: 1925773019-0
    • Opcode ID: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
    • Instruction ID: d0499dd1a11a7aa3f5f6b81cdb2be0183561266298d4129ec5ef95b8f2f1ff50
    • Opcode Fuzzy Hash: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
    • Instruction Fuzzy Hash: 12018430000200ABC704BFB2DD0D9DE7BA9AF95345722886EF90497212DA3CC9C28B5C
    APIs
    • VariantClear.OLEAUT32(00000038), ref: 004357C3
    • VariantClear.OLEAUT32(00000058), ref: 004357C9
    • VariantClear.OLEAUT32(00000068), ref: 004357CF
    • VariantClear.OLEAUT32(00000078), ref: 004357D5
    • VariantClear.OLEAUT32(00000088), ref: 004357DE
    • VariantClear.OLEAUT32(00000048), ref: 004357E4
    • VariantClear.OLEAUT32(00000098), ref: 004357ED
    • VariantClear.OLEAUT32(000000A8), ref: 004357F6
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ClearVariant
    • String ID:
    • API String ID: 1473721057-0
    • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
    • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
    • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
    • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
    APIs
    • WSAStartup.WSOCK32(00000101,?,?), ref: 00464ADE
      • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
    • inet_addr.WSOCK32(?,00000000,?,?,00000101,?,?), ref: 00464B1F
    • gethostbyname.WSOCK32(?,?,00000000,?,?,00000101,?,?), ref: 00464B29
    • _memset.LIBCMT ref: 00464B92
    • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
    • GlobalFree.KERNEL32(00000000), ref: 00464CDE
    • WSACleanup.WSOCK32 ref: 00464CE4
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memsetgethostbynameinet_addr
    • String ID:
    • API String ID: 3424476444-0
    • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
    • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
    • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
    • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
    APIs
    • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MetricsSystem
    • String ID:
    • API String ID: 4116985748-0
    • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
    • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
    • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
    • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
    APIs
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ConnectRegistry_wcslen
    • String ID:
    • API String ID: 535477410-0
    • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
    • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
    • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
    • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
    APIs
      • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
      • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
    • _memset.LIBCMT ref: 004538C4
    • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
    • _wcslen.LIBCMT ref: 00453960
    • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
    • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ItemMenu$Info_wcslen$Default_memset_wcscpy
    • String ID: 0
    • API String ID: 3530711334-4108050209
    • Opcode ID: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
    • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
    • Opcode Fuzzy Hash: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
    • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
    APIs
    • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
    • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
    • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
    • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Process$CloseCountersCurrentHandleOpen
    • String ID: HH
    • API String ID: 3488606520-2761332787
    • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
    • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
    • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
    • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
    APIs
      • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
      • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
      • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
      • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
      • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
    • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
    • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
    • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
    • LineTo.GDI32(?,?), ref: 004474BF
    • CloseFigure.GDI32(?), ref: 004474C6
    • SetPixel.GDI32(?,?,?,?), ref: 004474D6
    • Rectangle.GDI32(?,?), ref: 004474F3
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
    • String ID:
    • API String ID: 4082120231-0
    • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
    • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
    • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
    • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
    APIs
      • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
      • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
      • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
      • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
      • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
    • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
    • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
    • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
    • LineTo.GDI32(?,?), ref: 004474BF
    • CloseFigure.GDI32(?), ref: 004474C6
    • SetPixel.GDI32(?,?,?,?), ref: 004474D6
    • Rectangle.GDI32(?,?), ref: 004474F3
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
    • String ID:
    • API String ID: 4082120231-0
    • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
    • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
    • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
    • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
    • String ID:
    • API String ID: 288456094-0
    • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
    • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
    • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
    • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
    APIs
    • GetParent.USER32(?), ref: 004449B0
    • GetKeyboardState.USER32(?), ref: 004449C3
    • SetKeyboardState.USER32(?), ref: 00444A0F
    • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
    • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
    • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
    • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessagePost$KeyboardState$Parent
    • String ID:
    • API String ID: 87235514-0
    • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
    • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
    • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
    • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
    APIs
    • GetParent.USER32(?), ref: 00444BA9
    • GetKeyboardState.USER32(?), ref: 00444BBC
    • SetKeyboardState.USER32(?), ref: 00444C08
    • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
    • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
    • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
    • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessagePost$KeyboardState$Parent
    • String ID:
    • API String ID: 87235514-0
    • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
    • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
    • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
    • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
    • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
    • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
    • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
    APIs
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ConnectRegistry_wcslen
    • String ID: HH
    • API String ID: 535477410-2761332787
    • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
    • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
    • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
    • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
    APIs
    • _memset.LIBCMT ref: 00457C34
    • _memset.LIBCMT ref: 00457CE8
    • ShellExecuteExW.SHELL32(?), ref: 00457D34
      • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
      • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
    • CloseHandle.KERNEL32(?), ref: 00457DDD
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _memset$CloseExecuteHandleShell_wcscpy_wcslen
    • String ID: <$@
    • API String ID: 1325244542-1426351568
    • Opcode ID: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
    • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
    • Opcode Fuzzy Hash: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
    • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
    APIs
    • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
    • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
    • __wsplitpath.LIBCMT ref: 004737E1
      • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
    • _wcscat.LIBCMT ref: 004737F6
    • __wcsicoll.LIBCMT ref: 00473818
    • Process32NextW.KERNEL32(00000000,?), ref: 00473844
    • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
    • String ID:
    • API String ID: 2547909840-0
    • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
    • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
    • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
    • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
    APIs
    • SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
    • ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
    • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
    • DeleteObject.GDI32(?), ref: 0045564E
    • DeleteObject.GDI32(?), ref: 0045565C
    • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
    • String ID:
    • API String ID: 2354583917-0
    • Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
    • Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
    • Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
    • Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54
    APIs
      • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
    • GetMenu.USER32 ref: 004776AA
    • GetMenuItemCount.USER32(00000000), ref: 004776CC
    • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
    • _wcslen.LIBCMT ref: 0047771A
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Menu$CountItemStringWindow_wcslen
    • String ID:
    • API String ID: 1823500076-0
    • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
    • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
    • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
    • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
    APIs
    • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
    • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
    • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
    • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
    • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
    • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
    • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$Enable$Show$MessageMoveSend
    • String ID:
    • API String ID: 896007046-0
    • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
    • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
    • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
    • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
    APIs
    • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
    • GetWindowLongW.USER32(?,000000F0), ref: 00441452
    • GetWindowLongW.USER32(?,000000F0), ref: 00441493
    • SendMessageW.USER32(01641B00,000000F1,00000000,00000000), ref: 004414C6
    • SendMessageW.USER32(01641B00,000000F1,00000001,00000000), ref: 004414F1
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$LongWindow
    • String ID:
    • API String ID: 312131281-0
    • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
    • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
    • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
    • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
    APIs
    • _memset.LIBCMT ref: 004484C4
    • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
    • IsMenu.USER32(?), ref: 0044857B
    • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
    • DrawMenuBar.USER32 ref: 004485E4
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Menu$Item$DrawInfoInsert_memset
    • String ID: 0
    • API String ID: 3866635326-4108050209
    • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
    • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
    • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
    • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
    APIs
    • InterlockedIncrement.KERNEL32 ref: 0047247C
    • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
    • Sleep.KERNEL32(0000000A), ref: 00472499
    • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
    • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Interlocked$DecrementIncrement$Sleep
    • String ID: 0vH
    • API String ID: 327565842-3662162768
    • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
    • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
    • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
    • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
    APIs
    • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
    • GetFocus.USER32 ref: 00448B1C
    • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
    • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
    • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
    • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
    • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$Enable$Show$FocusMessageSend
    • String ID:
    • API String ID: 3429747543-0
    • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
    • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
    • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
    • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
    APIs
    • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
    • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
    • __swprintf.LIBCMT ref: 0045D3CC
    • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ErrorMode$InformationVolume__swprintf
    • String ID: %lu$HH
    • API String ID: 3164766367-3924996404
    • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
    • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
    • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
    • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
    APIs
    • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450E24
    • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450E35
    • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450E43
    • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450E54
    • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450E62
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend
    • String ID: Msctls_Progress32
    • API String ID: 3850602802-3636473452
    • Opcode ID: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
    • Instruction ID: b51c377fab27852337593a8f268aff884918310fa347e0537580fa9f3b853d23
    • Opcode Fuzzy Hash: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
    • Instruction Fuzzy Hash: 2C2121712543007AE7209A65DC42F5BB3E9AFD8B24F214A0EF754B72D1C6B4F8418B58
    APIs
    • ImageList_Destroy.COMCTL32(?), ref: 00455451
    • ImageList_Destroy.COMCTL32(?), ref: 0045545F
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
    • DeleteObject.GDI32(?), ref: 0045564E
    • DeleteObject.GDI32(?), ref: 0045565C
    • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Destroy$DeleteImageList_ObjectWindow$Icon
    • String ID:
    • API String ID: 3985565216-0
    • Opcode ID: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
    • Instruction ID: 02eb1b45cc7e926b76574f27881fb1e8d9d372094f4d7b34cf8607babd6cb63d
    • Opcode Fuzzy Hash: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
    • Instruction Fuzzy Hash: EA213270200A019FCB20DF65CAD4B2A77A9BF45312F50855EED45CB352DB39EC45CB69
    APIs
    • ___set_flsgetvalue.LIBCMT ref: 00415737
    • __calloc_crt.LIBCMT ref: 00415743
    • __getptd.LIBCMT ref: 00415750
    • CreateThread.KERNEL32(00000000,?,0041568B,00000000,00000004,00000000), ref: 00415776
    • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00415786
    • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00415791
    • __dosmaperr.LIBCMT ref: 004157A9
      • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
      • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
    • String ID:
    • API String ID: 1269668773-0
    • Opcode ID: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
    • Instruction ID: 083f1b3d72dc2b4e3073d7627409da2efaae6cca9fbdfa2eb2c15b7cb2a145f7
    • Opcode Fuzzy Hash: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
    • Instruction Fuzzy Hash: 4511E672501604EFC720AF76DC868DF7BA4EF80334F21412FF525922D1DB788981966D
    APIs
      • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
      • Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF
    • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
    • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
    • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
    • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
    • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
    • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
    • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
    • String ID:
    • API String ID: 1957940570-0
    • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
    • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
    • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
    • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
    APIs
    • ___set_flsgetvalue.LIBCMT ref: 00415690
      • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
      • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
      • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
    • ___fls_getvalue@4.LIBCMT ref: 0041569B
      • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
    • ___fls_setvalue@8.LIBCMT ref: 004156AD
      • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
    • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
    • ExitThread.KERNEL32 ref: 004156BD
    • __freefls@4.LIBCMT ref: 004156D9
    • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
    • String ID:
    • API String ID: 4166825349-0
    • Opcode ID: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
    • Instruction ID: 1015f584654e325efa3cacb901eba7c9ae2b5aefa54885f90b4e6d99173acdac
    • Opcode Fuzzy Hash: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
    • Instruction Fuzzy Hash: 14F049745007009BD704BF72DD159DE7B69AF85345761C85FB80897222DA3DC9C1CB9C
    APIs
    • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
    • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
    • API String ID: 2574300362-3261711971
    • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
    • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
    • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
    • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
    • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
    • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
    • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
    APIs
    • GetClientRect.USER32(?,?), ref: 00433724
    • GetWindowRect.USER32(00000000,?), ref: 00433757
    • GetClientRect.USER32(0000001D,?), ref: 004337AC
    • GetSystemMetrics.USER32(0000000F), ref: 00433800
    • GetWindowRect.USER32(?,?), ref: 00433814
    • ScreenToClient.USER32(?,?), ref: 00433842
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Rect$Client$Window$MetricsScreenSystem
    • String ID:
    • API String ID: 3220332590-0
    • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
    • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
    • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
    • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _malloc_wcslen$_strcat_wcscpy
    • String ID:
    • API String ID: 1612042205-0
    • Opcode ID: de2929fcda50375e6e5cb9f1075b8832783a078aa1feca3c1cc6154b42d84a61
    • Instruction ID: 39b6431fb86a1cae222df6ecce28f21653e085caad8de22f1e35678e4483a9b6
    • Opcode Fuzzy Hash: de2929fcda50375e6e5cb9f1075b8832783a078aa1feca3c1cc6154b42d84a61
    • Instruction Fuzzy Hash: CD613B70504202EFCB10EF29D58096AB3E5FF48305B50496EF8859B306D738EE59DB9A
    APIs
    • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
    • SetKeyboardState.USER32(00000080), ref: 0044C59B
    • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
    • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
    • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
    • SendInput.USER32 ref: 0044C6E2
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessagePost$KeyboardState$InputSend
    • String ID:
    • API String ID: 2221674350-0
    • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
    • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
    • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
    • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcscpy$_wcscat
    • String ID:
    • API String ID: 2037614760-0
    • Opcode ID: f99e136c889cacb8689bc9f00eee4ad51686cf745bff212a4790763dd87d00cb
    • Instruction ID: 871aa96d6b0d5f43eceffdadd72b032f7becd6ba50fbda5e2bca5dd503650597
    • Opcode Fuzzy Hash: f99e136c889cacb8689bc9f00eee4ad51686cf745bff212a4790763dd87d00cb
    • Instruction Fuzzy Hash: 7D41BD31901A256BDE317F55D880BBB7358DFA1314F84006FF98247313EA6E5892C6BE
    APIs
    • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
    • GetWindowRect.USER32(?,?), ref: 00447C1B
    • ScreenToClient.USER32(?,?), ref: 00447C39
    • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
    • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
    • EndPaint.USER32(?,?), ref: 00447CD1
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
    • String ID:
    • API String ID: 4189319755-0
    • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
    • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
    • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
    • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
    APIs
    • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
      • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
    • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
    • EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
    • LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
    • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
      • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
      • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
      • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
    • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
    • String ID:
    • API String ID: 1726766782-0
    • Opcode ID: 3a1f833abb26ce593740c71d471a220e6d34013d7717cf1b73c6152b0bb325a5
    • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
    • Opcode Fuzzy Hash: 3a1f833abb26ce593740c71d471a220e6d34013d7717cf1b73c6152b0bb325a5
    • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
    APIs
    • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
    • EnableWindow.USER32(?,00000000), ref: 0044111A
    • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
    • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
    • EnableWindow.USER32(?,00000001), ref: 004411B3
    • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$Show$Enable$MessageSend
    • String ID:
    • API String ID: 642888154-0
    • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
    • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
    • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
    • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
    APIs
    • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
    • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
    • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
    • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
    • GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
    • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$LongWindow$InvalidateRect
    • String ID:
    • API String ID: 1976402638-0
    • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
    • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
    • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
    • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
    APIs
    • GetForegroundWindow.USER32 ref: 00442597
      • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
    • GetDesktopWindow.USER32 ref: 004425BF
    • GetWindowRect.USER32(00000000), ref: 004425C6
    • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
      • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
    • GetCursorPos.USER32(?), ref: 00442624
    • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
    • String ID:
    • API String ID: 4137160315-0
    • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
    • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
    • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
    • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
    APIs
    • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
    • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
    • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
    • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
    • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
    • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$Enable$Show$MessageSend
    • String ID:
    • API String ID: 1871949834-0
    • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
    • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
    • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
    • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
    APIs
    • _memset.LIBCMT ref: 0044961A
    • SendMessageW.USER32 ref: 0044964A
      • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
    • SendMessageW.USER32(?,00001074,?,00000001), ref: 004496AC
    • _wcslen.LIBCMT ref: 004496BA
    • _wcslen.LIBCMT ref: 004496C7
    • SendMessageW.USER32(?,00001074,?,?), ref: 004496FD
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$_wcslen$_memset_wcspbrk
    • String ID:
    • API String ID: 1624073603-0
    • Opcode ID: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
    • Instruction ID: 7e49a266cf7116299f7bc8659d1ce07b00adedb8b3f1b428e1954e4b11147a1e
    • Opcode Fuzzy Hash: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
    • Instruction Fuzzy Hash: B631CA71508300AAE720DF15DC81BEBB7D4EBD4720F504A1FFA54862D0EBBAD945C7A6
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
    • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
    • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
    • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
    APIs
    • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
    • DeleteObject.GDI32(?), ref: 0045564E
    • DeleteObject.GDI32(?), ref: 0045565C
    • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: DestroyWindow$DeleteObject$IconMove
    • String ID:
    • API String ID: 1640429340-0
    • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
    • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
    • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
    • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __fileno__setmode$DebugOutputString_fprintf
    • String ID:
    • API String ID: 3354276064-0
    • Opcode ID: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
    • Instruction ID: 1e9a75ed7ce68f0ee686932f25d41d1f14ae1a91d469003489e3a0780bce169f
    • Opcode Fuzzy Hash: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
    • Instruction Fuzzy Hash: 6D11F3B2D0830136D500BA366C02AAF7A5C4A91B5CF44056EFD4563293EA2DAA4943FF
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Destroy$DeleteMenuObject$IconWindow
    • String ID:
    • API String ID: 752480666-0
    • Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
    • Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
    • Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
    • Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59
    APIs
    • DestroyWindow.USER32(00000000), ref: 0045527A
    • ImageList_Destroy.COMCTL32(?), ref: 0045528C
    • DeleteObject.GDI32(?), ref: 0045564E
    • DeleteObject.GDI32(?), ref: 0045565C
    • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Destroy$DeleteObjectWindow$IconImageList_
    • String ID:
    • API String ID: 3275902921-0
    • Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
    • Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
    • Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
    • Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68
    APIs
    • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
    • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
    • CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
    • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
    • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
    • DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
    • String ID:
    • API String ID: 1413079979-0
    • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
    • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
    • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
    • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
    APIs
    • ___set_flsgetvalue.LIBCMT ref: 0041418F
    • __calloc_crt.LIBCMT ref: 0041419B
    • __getptd.LIBCMT ref: 004141A8
    • CreateThread.KERNEL32(?,?,004140DB,00000000,?,?), ref: 004141DF
    • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004141E9
    • __dosmaperr.LIBCMT ref: 00414201
      • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
      • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
    • String ID:
    • API String ID: 1803633139-0
    • Opcode ID: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
    • Instruction ID: ec3febacf030228bba34671a5a373aa86179f0c9a00f1e1343e4adce14cbcb36
    • Opcode Fuzzy Hash: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
    • Instruction Fuzzy Hash: 1311DD72504209BFCB10AFA5DC828DF7BA8EF44368B20446EF50193151EB39C9C18A68
    APIs
    • ImageList_Destroy.COMCTL32(?), ref: 004555E8
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
    • DeleteObject.GDI32(?), ref: 0045564E
    • DeleteObject.GDI32(?), ref: 0045565C
    • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Destroy$DeleteObjectWindow$IconImageList_
    • String ID:
    • API String ID: 3275902921-0
    • Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
    • Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
    • Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
    • Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59
    APIs
    • SendMessageW.USER32 ref: 004554DF
    • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
    • DeleteObject.GDI32(?), ref: 0045564E
    • DeleteObject.GDI32(?), ref: 0045565C
    • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: DeleteDestroyMessageObjectSend$IconWindow
    • String ID:
    • API String ID: 3691411573-0
    • Opcode ID: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
    • Instruction ID: ead105b7aa3a144aa2df3f4c31681f961a0d6b706109639263d1a652a664e8ec
    • Opcode Fuzzy Hash: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
    • Instruction Fuzzy Hash: A5118F713046419BDB10DF68DD88A2A77A8FB58322F404A2AFE14DB2D1D775DC498B68
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcslen$_wcstok$ExtentPoint32Text
    • String ID:
    • API String ID: 1814673581-0
    • Opcode ID: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
    • Instruction ID: 25d714350c6a951fb861184d208c8546153e966ae5ec0a2422e5c8358eb53325
    • Opcode Fuzzy Hash: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
    • Instruction Fuzzy Hash: F60125B19053126BC6209F95DC42B5BB7E8EF45760F11842AFD04E3340D7F8E84483EA
    APIs
    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
    • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: PerformanceQuery$CounterSleep$Frequency
    • String ID:
    • API String ID: 2833360925-0
    • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
    • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
    • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
    • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
    APIs
      • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
      • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
      • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
      • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
      • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
    • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
    • LineTo.GDI32(?,?,?), ref: 00447227
    • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
    • LineTo.GDI32(?,?,?), ref: 0044723D
    • EndPath.GDI32(?), ref: 0044724E
    • StrokePath.GDI32(?), ref: 0044725C
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
    • String ID:
    • API String ID: 372113273-0
    • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
    • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
    • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
    • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
    APIs
    • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
    • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
    • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
    • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
    • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
    • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Virtual
    • String ID:
    • API String ID: 4278518827-0
    • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
    • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
    • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
    • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
    APIs
    • GetDC.USER32(00000000), ref: 0044CBEF
    • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC00
    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC09
    • ReleaseDC.USER32(00000000,00000000), ref: 0044CC10
    • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CC29
    • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0044CC37
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CapsDevice$Release
    • String ID:
    • API String ID: 1035833867-0
    • Opcode ID: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
    • Instruction ID: 50bf861fd692b93b916a63282857a41227f0dfa19545bc4f0a59f576ae553c11
    • Opcode Fuzzy Hash: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
    • Instruction Fuzzy Hash: 560184B1641314BFF6009BA1DC4AF1BBB9CEF55755F01842EFF44A7241D6B098008BA9
    APIs
    • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
    • EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
    • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
    • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
      • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
    • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
    • LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
    • String ID:
    • API String ID: 3495660284-0
    • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
    • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
    • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
    • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
    APIs
    • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
    • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
    • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
    • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
    • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
    • CloseHandle.KERNEL32(00000000), ref: 00437174
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
    • String ID:
    • API String ID: 839392675-0
    • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
    • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
    • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
    • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
    APIs
    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,00000004), ref: 00436055
    • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
    • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
    • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
    • GetLastError.KERNEL32 ref: 00436081
    • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
    • String ID:
    • API String ID: 1690418490-0
    • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
    • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
    • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
    • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
    APIs
      • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
    • CoInitialize.OLE32(00000000), ref: 00475B71
    • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
    • CoUninitialize.OLE32 ref: 00475D71
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CreateInitializeInstanceUninitialize_wcslen
    • String ID: .lnk$HH
    • API String ID: 886957087-3121654589
    • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
    • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
    • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
    • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Menu$Delete$InfoItem_memset
    • String ID: 0
    • API String ID: 1173514356-4108050209
    • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
    • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
    • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
    • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
    APIs
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
    • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
    • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
      • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$_wcslen
    • String ID: ComboBox$ListBox
    • API String ID: 763830540-1403004172
    • Opcode ID: 169cb05da2f7371639be8c7bcea77e944b24e4bfad061a6cd0ac94a92c737455
    • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
    • Opcode Fuzzy Hash: 169cb05da2f7371639be8c7bcea77e944b24e4bfad061a6cd0ac94a92c737455
    • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
    APIs
    • GetStdHandle.KERNEL32(?), ref: 004439B4
      • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,771B2EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
      • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
      • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CurrentHandleProcess$Duplicate
    • String ID: nul
    • API String ID: 2124370227-2873401336
    • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
    • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
    • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
    • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
    APIs
    • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
      • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,771B2EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
      • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
      • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CurrentHandleProcess$Duplicate
    • String ID: nul
    • API String ID: 2124370227-2873401336
    • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
    • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
    • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
    • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
    APIs
    • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
    • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
    • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
    • DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$DestroyLibraryLoadWindow
    • String ID: SysAnimate32
    • API String ID: 3529120543-1011021900
    • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
    • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
    • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
    • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
    APIs
    • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
    • TranslateMessage.USER32(?), ref: 0044308B
    • DispatchMessageW.USER32(?), ref: 00443096
    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Message$Peek$DispatchTranslate
    • String ID: *.*
    • API String ID: 1795658109-438819550
    • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
    • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
    • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
    • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
    APIs
      • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
      • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
      • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
      • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
      • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
    • GetFocus.USER32 ref: 004609EF
      • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
      • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
    • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
    • EnumChildWindows.USER32(?,00445A31,?), ref: 00460A60
    • __swprintf.LIBCMT ref: 00460A7A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_wcslen
    • String ID: %s%d
    • API String ID: 991886796-1110647743
    • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
    • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
    • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
    • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _memset$_sprintf
    • String ID: %02X
    • API String ID: 891462717-436463671
    • Opcode ID: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
    • Instruction ID: c3235ccac5cd273424cb9b73a8b9e0f10e05fa8943de770f4571b5c3e9b76774
    • Opcode Fuzzy Hash: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
    • Instruction Fuzzy Hash: 5B11E97225021167D314FA698C93BEE724CAB45704F50453FF541A75C1EF6CB558839E
    APIs
    • _memset.LIBCMT ref: 0042CD00
    • GetOpenFileNameW.COMDLG32 ref: 0042CD51
      • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,?,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,004A8E80,C:\Users\user\Desktop\PGHPC-10-0033-FZB-001.exe,0040F3D2), ref: 0040FFCA
      • Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
      • Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
      • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 00410160
      • Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
      • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 004101AC
      • Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: NamePath$Full_wcscpy$DesktopFileFolderFromListMallocOpen_memset
    • String ID: $OH$@OH$X
    • API String ID: 3491138722-1394974532
    • Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
    • Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
    • Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
    • Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A
    APIs
    • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
    • GetProcAddress.KERNEL32(?,?), ref: 00463E68
    • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
    • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
    • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AddressProc$Library$FreeLoad
    • String ID:
    • API String ID: 2449869053-0
    • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
    • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
    • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
    • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
    APIs
    • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
    • SetKeyboardState.USER32(00000080), ref: 0044C3ED
    • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
    • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
    • SendInput.USER32 ref: 0044C509
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: KeyboardMessagePostState$InputSend
    • String ID:
    • API String ID: 3031425849-0
    • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
    • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
    • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
    • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
    APIs
    • RegEnumKeyExW.ADVAPI32 ref: 004422F0
    • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
    • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
    • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
    • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Enum$CloseDeleteOpen
    • String ID:
    • API String ID: 2095303065-0
    • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
    • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
    • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
    • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
    APIs
    • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
    • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
    • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
    • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
    • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: PrivateProfile$SectionWrite$String
    • String ID:
    • API String ID: 2832842796-0
    • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
    • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
    • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
    • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
    APIs
    • GetClientRect.USER32(?,?), ref: 00447997
    • GetCursorPos.USER32(?), ref: 004479A2
    • ScreenToClient.USER32(?,?), ref: 004479BE
    • WindowFromPoint.USER32(?,?), ref: 004479FF
    • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447A78
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Client$CursorFromPointProcRectScreenWindow
    • String ID:
    • API String ID: 1822080540-0
    • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
    • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
    • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
    • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
    APIs
    • GetWindowRect.USER32(?,?), ref: 00447C1B
    • ScreenToClient.USER32(?,?), ref: 00447C39
    • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
    • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
    • EndPaint.USER32(?,?), ref: 00447CD1
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ClientPaintRectRectangleScreenViewportWindow
    • String ID:
    • API String ID: 659298297-0
    • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
    • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
    • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
    • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
    APIs
    • GetCursorPos.USER32(?), ref: 004478A7
    • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
    • DefDlgProcW.USER32(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
    • GetCursorPos.USER32(?), ref: 00447935
    • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CursorMenuPopupTrack$Proc
    • String ID:
    • API String ID: 1300944170-0
    • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
    • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
    • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
    • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
    APIs
    • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
    • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
    • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
    • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
    • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
      • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
      • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441452
      • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441493
      • Part of subcall function 004413F0: SendMessageW.USER32(01641B00,000000F1,00000000,00000000), ref: 004414C6
      • Part of subcall function 004413F0: SendMessageW.USER32(01641B00,000000F1,00000001,00000000), ref: 004414F1
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$EnableMessageSend$LongShow
    • String ID:
    • API String ID: 142311417-0
    • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
    • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
    • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
    • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
    APIs
    • _memset.LIBCMT ref: 0044955A
      • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
    • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 004495B3
    • _wcslen.LIBCMT ref: 004495C1
    • _wcslen.LIBCMT ref: 004495CE
    • SendMessageW.USER32(?,00001060,00000000,?), ref: 004495FF
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend_wcslen$_memset_wcspbrk
    • String ID:
    • API String ID: 1843234404-0
    • Opcode ID: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
    • Instruction ID: 2eba0e6ca7bf2f01d6f4dc0284c8cedbdf4c7ea0b5caad0642d64795040b3bc6
    • Opcode Fuzzy Hash: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
    • Instruction Fuzzy Hash: 1821F87260430556E630EB15AC81BFBB3D8EBD0761F10483FEE4081280E67E9959D3AA
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
    • Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
    • Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
    • Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9
    APIs
    • IsWindowVisible.USER32(?), ref: 00445721
    • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
    • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
    • _wcslen.LIBCMT ref: 004457A3
    • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
    • String ID:
    • API String ID: 3087257052-0
    • Opcode ID: b8615011704e714012d326b35a72e373024cdcb02b0b49a0115346f3c93ca327
    • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
    • Opcode Fuzzy Hash: b8615011704e714012d326b35a72e373024cdcb02b0b49a0115346f3c93ca327
    • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
    APIs
    • IsWindow.USER32(00000000), ref: 00459DEF
    • GetForegroundWindow.USER32 ref: 00459E07
    • GetDC.USER32(00000000), ref: 00459E44
    • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
    • ReleaseDC.USER32(00000000,00000000), ref: 00459E8B
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$ForegroundPixelRelease
    • String ID:
    • API String ID: 4156661090-0
    • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
    • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
    • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
    • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
    APIs
      • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
    • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 00464985
    • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
    • connect.WSOCK32(00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649CD
    • WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
    • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 00464A07
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ErrorLast$closesocketconnectinet_addrsocket
    • String ID:
    • API String ID: 245547762-0
    • Opcode ID: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
    • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
    • Opcode Fuzzy Hash: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
    • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
    APIs
    • DeleteObject.GDI32(00000000), ref: 00447151
    • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
    • SelectObject.GDI32(?,00000000), ref: 004471A2
    • BeginPath.GDI32(?), ref: 004471B7
    • SelectObject.GDI32(?,00000000), ref: 004471DC
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Object$Select$BeginCreateDeletePath
    • String ID:
    • API String ID: 2338827641-0
    • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
    • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
    • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
    • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
    APIs
    • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
    • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
    • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CounterPerformanceQuerySleep
    • String ID:
    • API String ID: 2875609808-0
    • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
    • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
    • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
    • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
    APIs
    • SendMessageW.USER32 ref: 0046FD00
    • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
    • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
    • DestroyIcon.USER32(?), ref: 0046FD58
    • DestroyIcon.USER32(?), ref: 0046FD5F
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$DestroyIcon
    • String ID:
    • API String ID: 3419509030-0
    • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
    • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
    • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
    • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
    APIs
    • __getptd.LIBCMT ref: 004175AE
      • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
      • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
    • __amsg_exit.LIBCMT ref: 004175CE
    • __lock.LIBCMT ref: 004175DE
    • InterlockedDecrement.KERNEL32(?), ref: 004175FB
    • InterlockedIncrement.KERNEL32(016417F0), ref: 00417626
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
    • String ID:
    • API String ID: 4271482742-0
    • Opcode ID: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
    • Instruction ID: de548182bd5f57d4f8c9f8a4c79293bfa6802d75d0085d2526eaa3c6a777046b
    • Opcode Fuzzy Hash: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
    • Instruction Fuzzy Hash: 9401AD31944A11AFC710ABA998497CE7BB0BB11724F0540ABE80063791CB3CA9C1CFEE
    APIs
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
    • DeleteObject.GDI32(?), ref: 0045564E
    • DeleteObject.GDI32(?), ref: 0045565C
    • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Destroy$DeleteObjectWindow$Icon
    • String ID:
    • API String ID: 4023252218-0
    • Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
    • Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
    • Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
    • Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69
    APIs
    • GetDlgItem.USER32(?,000003E9), ref: 00460342
    • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
    • MessageBeep.USER32(00000000), ref: 0046036D
    • KillTimer.USER32(?,0000040A), ref: 00460392
    • EndDialog.USER32(?,00000001), ref: 004603AB
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: BeepDialogItemKillMessageTextTimerWindow
    • String ID:
    • API String ID: 3741023627-0
    • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
    • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
    • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
    • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
    APIs
    • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
    • DeleteObject.GDI32(?), ref: 0045564E
    • DeleteObject.GDI32(?), ref: 0045565C
    • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: DeleteDestroyObject$IconMessageSendWindow
    • String ID:
    • API String ID: 1489400265-0
    • Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
    • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
    • Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
    • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
    APIs
      • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
    • DeleteObject.GDI32(?), ref: 0045564E
    • DeleteObject.GDI32(?), ref: 0045565C
    • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
    • String ID:
    • API String ID: 1042038666-0
    • Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
    • Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
    • Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
    • Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Path$ObjectStroke$DeleteFillSelect
    • String ID:
    • API String ID: 2625713937-0
    • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
    • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
    • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
    • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
    APIs
      • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
    • ___set_flsgetvalue.LIBCMT ref: 004140E1
      • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
      • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
      • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
    • ___fls_getvalue@4.LIBCMT ref: 004140EC
      • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
    • ___fls_setvalue@8.LIBCMT ref: 004140FF
      • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
    • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
    • ExitThread.KERNEL32 ref: 0041410F
    • GetCurrentThreadId.KERNEL32 ref: 00414115
    • __freefls@4.LIBCMT ref: 00414135
    • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
    • String ID:
    • API String ID: 132634196-0
    • Opcode ID: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
    • Instruction ID: c6f54ac6c47f72d6c6be617d0ab0d95393642b3a08ca47198428750b18cc63fb
    • Opcode Fuzzy Hash: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
    • Instruction Fuzzy Hash: EFE0B6318012096B8F0177F28E2A8DF3A2DAD56799B12842EBF10A3112DA6DD9D147AD
    APIs
    • __IsNonwritableInCurrentImage.LIBCMT ref: 00415610
      • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
    • __getptd_noexit.LIBCMT ref: 00415620
    • CloseHandle.KERNEL32(?,?,0041566B), ref: 00415634
    • __freeptd.LIBCMT ref: 0041563B
    • ExitThread.KERNEL32 ref: 00415643
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
    • String ID:
    • API String ID: 3798957060-0
    • Opcode ID: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
    • Instruction ID: 5ad9b57b40d8b41da6f03c32f2a15b2799e0bbfe2e5ad1689210a27a588f1b2a
    • Opcode Fuzzy Hash: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
    • Instruction Fuzzy Hash: 29E01A31501A1197C2212BB9AC097DE3255AF01F36F944A6EF81A952A0DB6CD98147AD
    APIs
      • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
    • ___set_flsgetvalue.LIBCMT ref: 00415690
      • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
      • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
      • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
    • ___fls_getvalue@4.LIBCMT ref: 0041569B
      • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
    • ___fls_setvalue@8.LIBCMT ref: 004156AD
      • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
    • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
    • ExitThread.KERNEL32 ref: 004156BD
    • __freefls@4.LIBCMT ref: 004156D9
    • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
    • String ID:
    • API String ID: 1537469427-0
    • Opcode ID: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
    • Instruction ID: 6f4b581ce684dac4bce1a6396b1ab204a3b2196504341234b7a244e47b3a25b0
    • Opcode Fuzzy Hash: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
    • Instruction Fuzzy Hash: 83E0E6308003096BCF0037F29E1A9DF392DAD41389B52841E7E14B2122DE6DD9D1466D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _malloc
    • String ID: Default$|k
    • API String ID: 1579825452-2254895183
    • Opcode ID: becd5b91230c6b3cce4541e76e7ed3885ca0e1da08972e6e30288734a84e99a9
    • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
    • Opcode Fuzzy Hash: becd5b91230c6b3cce4541e76e7ed3885ca0e1da08972e6e30288734a84e99a9
    • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _memcmp
    • String ID: '$[$h
    • API String ID: 2931989736-1224472061
    • Opcode ID: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
    • Instruction ID: c2eec353cbd26a418970a1643da97c958d9efd09d44d369c5aec2a2e92b02032
    • Opcode Fuzzy Hash: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
    • Instruction Fuzzy Hash: EBE1B3756083858FE725CF28C8807ABBBE1FFC9304F18896EE89587341D7799849CB56
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _strncmp
    • String ID: >$R$U
    • API String ID: 909875538-1924298640
    • Opcode ID: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
    • Instruction ID: f6794502b7c89560a677b30a08de70cb8bc1b17d125f16f135907c58c8460d8d
    • Opcode Fuzzy Hash: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
    • Instruction Fuzzy Hash: 46E19C745083818FEB25CF29C49076BBBE1EFD9304F28496EE89587381D378E849CB56
    APIs
      • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
    • CoInitialize.OLE32(00000000), ref: 0046CE18
    • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
    • CoUninitialize.OLE32 ref: 0046CE50
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CreateInitializeInstanceUninitialize_wcslen
    • String ID: .lnk
    • API String ID: 886957087-24824748
    • Opcode ID: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
    • Instruction ID: 09ec1e36491b9dee8eccbfa157b0fc1a83632a56aae6c10d58f94140378ad3aa
    • Opcode Fuzzy Hash: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
    • Instruction Fuzzy Hash: D3A1ABB5A042019FC704EF64C980E6BB7E9EF88714F14895EF8849B392D735EC45CBA6
    Strings
    • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00469C37
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcslen
    • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
    • API String ID: 176396367-557222456
    • Opcode ID: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
    • Instruction ID: 5ec49088f7a0f5eff408c40ec761cfb1cab3d77d8e9f1d748350f88cc39ab646
    • Opcode Fuzzy Hash: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
    • Instruction Fuzzy Hash: 2C818F715183009FC310EF65C88186BB7E8AF85714F408A2FF5959B2A2E778ED45CB9B
    APIs
      • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
    • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
    • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
    • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Variant$ClearCopyInit_malloc
    • String ID: 4RH
    • API String ID: 2981388473-749298218
    • Opcode ID: 0ecc23cf10d45d221d402e646a959f016f56f7df0d424eb76d23c0d4b9967ba2
    • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
    • Opcode Fuzzy Hash: 0ecc23cf10d45d221d402e646a959f016f56f7df0d424eb76d23c0d4b9967ba2
    • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
    APIs
      • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
      • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
    • __wcsnicmp.LIBCMT ref: 0046681A
    • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Connection__wcsnicmp_wcscpy_wcslen
    • String ID: LPT$HH
    • API String ID: 3035604524-2728063697
    • Opcode ID: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
    • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
    • Opcode Fuzzy Hash: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
    • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
    APIs
      • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
    • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
      • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
    • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
    • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$MemoryProcess$ReadWrite
    • String ID: @
    • API String ID: 4055202900-2766056989
    • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
    • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
    • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
    • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CrackInternet_memset_wcslen
    • String ID: |
    • API String ID: 915713708-2343686810
    • Opcode ID: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
    • Instruction ID: 59fb16093b155e5aebf0565036b17e76eaaa1a90c891d08183ce313382d628e9
    • Opcode Fuzzy Hash: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
    • Instruction Fuzzy Hash: AE417EB2754301ABD204EF69DC81B9BF7E8FB88714F00052EF64593290DB75E909CBA6
    APIs
    • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
    • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
    • HttpQueryInfoW.WININET ref: 0044A892
      • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
    • String ID:
    • API String ID: 3705125965-3916222277
    • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
    • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
    • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
    • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
    APIs
    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
    • GetWindowLongW.USER32(?,000000F0), ref: 00450AA2
    • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00450AB3
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$Long
    • String ID: SysTreeView32
    • API String ID: 847901565-1698111956
    • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
    • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
    • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
    • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
    APIs
    • LoadLibraryA.KERNEL32(?), ref: 00437CB2
    • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
    • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Library$AddressFreeLoadProc
    • String ID: AU3_GetPluginDetails
    • API String ID: 145871493-4132174516
    • Opcode ID: e60d032cda8e07fae4321829b238a90b33a1110472f30aca6681d3aeba7a8f27
    • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
    • Opcode Fuzzy Hash: e60d032cda8e07fae4321829b238a90b33a1110472f30aca6681d3aeba7a8f27
    • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
    APIs
    • DestroyWindow.USER32(00000000,004A83D8,00000000,?,?), ref: 00450C60
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: DestroyWindow
    • String ID: msctls_updown32
    • API String ID: 3375834691-2298589950
    • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
    • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
    • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
    • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
    APIs
    • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
    • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
    • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$MoveWindow
    • String ID: Listbox
    • API String ID: 3315199576-2633736733
    • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
    • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
    • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
    • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
    APIs
    • SetErrorMode.KERNEL32(00000001), ref: 0045D243
    • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
    • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ErrorMode$InformationVolume
    • String ID: HH
    • API String ID: 2507767853-2761332787
    • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
    • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
    • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
    • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
    APIs
    • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
    • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
    • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ErrorMode$InformationVolume
    • String ID: HH
    • API String ID: 2507767853-2761332787
    • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
    • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
    • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
    • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
    APIs
    • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
    • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
    • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend
    • String ID: msctls_trackbar32
    • API String ID: 3850602802-1010561917
    • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
    • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
    • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
    • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
    APIs
      • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
    • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046BD78
    • WSAGetLastError.WSOCK32(00000000,?,?,00000000,?,?), ref: 0046BD83
    • inet_ntoa.WSOCK32(00000000,?), ref: 0046BDCD
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
    • String ID: HH
    • API String ID: 1515696956-2761332787
    • Opcode ID: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
    • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
    • Opcode Fuzzy Hash: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
    • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
    APIs
      • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
    • GetMenuItemInfoW.USER32 ref: 004497EA
    • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
    • DrawMenuBar.USER32 ref: 00449828
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Menu$InfoItem$Draw_malloc
    • String ID: 0
    • API String ID: 772068139-4108050209
    • Opcode ID: c8976dca06d6b4a67e3115e3fbda4fe950bcb9b91ddbb3afb2d21d0cb6793a10
    • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
    • Opcode Fuzzy Hash: c8976dca06d6b4a67e3115e3fbda4fe950bcb9b91ddbb3afb2d21d0cb6793a10
    • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AllocTask_wcslen
    • String ID: hkG
    • API String ID: 2651040394-3610518997
    • Opcode ID: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
    • Instruction ID: 372044899b15e8c53ead78f1c779643819f92c4817f04f111663958edd7e2adf
    • Opcode Fuzzy Hash: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
    • Instruction Fuzzy Hash: DCE065736442225B97506A79AC045CBA7D8AFB0370B15482BF880E7310E278E89643E5
    APIs
    • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
    • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: GetSystemWow64DirectoryW$kernel32.dll
    • API String ID: 2574300362-1816364905
    • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
    • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
    • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
    • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
    APIs
    • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,?,?,00000000,?,?,00000101,?), ref: 004343DE
    • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: ICMP.DLL$IcmpSendEcho
    • API String ID: 2574300362-58917771
    • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
    • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
    • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
    • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
    APIs
    • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
    • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: ICMP.DLL$IcmpCloseHandle
    • API String ID: 2574300362-3530519716
    • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
    • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
    • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
    • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
    APIs
    • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
    • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: ICMP.DLL$IcmpCreateFile
    • API String ID: 2574300362-275556492
    • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
    • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
    • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
    • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
    APIs
    • LoadLibraryA.KERNEL32(kernel32.dll,0040E551,?), ref: 0040EE7B
    • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040EE8D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: AddressLibraryLoadProc
    • String ID: IsWow64Process$kernel32.dll
    • API String ID: 2574300362-3024904723
    • Opcode ID: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
    • Instruction ID: 75875fa2f3f8b89ed4c8cde0d061cde3839b728dd3838c322d7dfd2ddbff31fa
    • Opcode Fuzzy Hash: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
    • Instruction Fuzzy Hash: 51D0C9B0940707DAC7301F72C91871B7AE4AB40342F204C3EB995A1290DBBCC0408B28
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ClearVariant
    • String ID:
    • API String ID: 1473721057-0
    • Opcode ID: d2d12c55b876e5fa1efbcf51686f09b2c55b87fd727dd21d929d390e382c4fef
    • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
    • Opcode Fuzzy Hash: d2d12c55b876e5fa1efbcf51686f09b2c55b87fd727dd21d929d390e382c4fef
    • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
    APIs
    • __flush.LIBCMT ref: 00414630
    • __fileno.LIBCMT ref: 00414650
    • __locking.LIBCMT ref: 00414657
    • __flsbuf.LIBCMT ref: 00414682
      • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
      • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
    • String ID:
    • API String ID: 3240763771-0
    • Opcode ID: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
    • Instruction ID: ec1a4dff6c5341ad57a53ba98b0f539b864df2cc4a0ba96fecd891c5d8a4160d
    • Opcode Fuzzy Hash: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
    • Instruction Fuzzy Hash: 4841A571A00605ABDB249FA5C9445DFB7B6EFC1328F28852FE41997280D77CDEC18B48
    APIs
    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
    • VariantCopy.OLEAUT32(?,?), ref: 00478259
    • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
    • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CopyVariant$ErrorLast
    • String ID:
    • API String ID: 2286883814-0
    • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
    • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
    • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
    • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
    APIs
    • socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
    • WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
    • #21.WSOCK32 ref: 004740E0
    • WSAGetLastError.WSOCK32(00000000), ref: 004740EB
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ErrorLast$socket
    • String ID:
    • API String ID: 1881357543-0
    • Opcode ID: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
    • Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
    • Opcode Fuzzy Hash: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
    • Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C
    APIs
    • ClientToScreen.USER32(00000000,?), ref: 00441CDE
    • GetWindowRect.USER32(?,?), ref: 00441D5A
    • PtInRect.USER32(?,?,?), ref: 00441D6F
    • MessageBeep.USER32(00000000), ref: 00441DF2
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Rect$BeepClientMessageScreenWindow
    • String ID:
    • API String ID: 1352109105-0
    • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
    • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
    • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
    • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
    APIs
    • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042387E
    • __isleadbyte_l.LIBCMT ref: 004238B2
    • MultiByteToWideChar.KERNEL32(?,00000009,00000002,?,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 004238E3
    • MultiByteToWideChar.KERNEL32(?,00000009,00000002,00000001,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 00423951
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
    • String ID:
    • API String ID: 3058430110-0
    • Opcode ID: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
    • Instruction ID: 550681b3841f0f34ee613cb5364b25607849a03987ccfca5eaaec14299199b49
    • Opcode Fuzzy Hash: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
    • Instruction Fuzzy Hash: A931C270B00265EFDB20EF64D8849AA7BF5EF01312B9445AAF0A09F291D338CE81CB55
    APIs
    • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
    • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
    • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
    • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CreateHardLink$DeleteErrorFileLast
    • String ID:
    • API String ID: 3321077145-0
    • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
    • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
    • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
    • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
    APIs
    • GetParent.USER32(?), ref: 004505BF
    • DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
    • DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
    • DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Proc$Parent
    • String ID:
    • API String ID: 2351499541-0
    • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
    • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
    • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
    • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
    APIs
      • Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95
      • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
    • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 00461420
    • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 0046144F
    • __itow.LIBCMT ref: 00461461
    • __itow.LIBCMT ref: 004614AB
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$__itow$_wcslen
    • String ID:
    • API String ID: 2875217250-0
    • Opcode ID: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
    • Instruction ID: b65c482f8247f617b799fd724a7506577ebf884cdb52d0d4602b18db992df379
    • Opcode Fuzzy Hash: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
    • Instruction Fuzzy Hash: 3A213D7670031067D210BA169C86FAFB794EB94714F08443FFF44AB241EE69E94687EB
    APIs
    • GetForegroundWindow.USER32 ref: 00472806
      • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
      • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
      • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
    • GetCaretPos.USER32(?), ref: 0047281A
    • ClientToScreen.USER32(00000000,?), ref: 00472856
    • GetForegroundWindow.USER32 ref: 0047285C
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
    • String ID:
    • API String ID: 2759813231-0
    • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
    • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
    • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
    • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
    APIs
      • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
    • GetWindowLongW.USER32(?,000000EC), ref: 0047728E
    • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
    • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
    • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$Long$AttributesLayered
    • String ID:
    • API String ID: 2169480361-0
    • Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
    • Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
    • Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
    • Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8
    APIs
    • SendMessageW.USER32 ref: 00448CB8
    • GetWindowLongW.USER32(?,000000EC), ref: 00448CE0
    • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
    • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend$LongWindow
    • String ID:
    • API String ID: 312131281-0
    • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
    • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
    • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
    • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
    APIs
    • select.WSOCK32 ref: 0045890A
    • __WSAFDIsSet.WSOCK32(00000000,00000000), ref: 00458919
    • accept.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 00458927
    • WSAGetLastError.WSOCK32(00000000), ref: 00458952
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ErrorLastacceptselect
    • String ID:
    • API String ID: 385091864-0
    • Opcode ID: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
    • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
    • Opcode Fuzzy Hash: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
    • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
    APIs
    • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend
    • String ID:
    • API String ID: 3850602802-0
    • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
    • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
    • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
    • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
    APIs
    • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
    • GetStockObject.GDI32(00000011), ref: 00433695
    • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
    • ShowWindow.USER32(00000000,00000000), ref: 004336BA
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Window$CreateMessageObjectSendShowStock
    • String ID:
    • API String ID: 1358664141-0
    • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
    • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
    • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
    • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
    APIs
    • GetCurrentThreadId.KERNEL32 ref: 004441B8
    • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
    • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
    • CloseHandle.KERNEL32(00000000), ref: 00444213
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
    • String ID:
    • API String ID: 2880819207-0
    • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
    • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
    • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
    • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
    APIs
    • GetWindowRect.USER32(?,?), ref: 00434037
    • ScreenToClient.USER32(?,?), ref: 0043405B
    • ScreenToClient.USER32(?,?), ref: 00434085
    • InvalidateRect.USER32(?,?,?), ref: 004340A4
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ClientRectScreen$InvalidateWindow
    • String ID:
    • API String ID: 357397906-0
    • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
    • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
    • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
    • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
    APIs
    • __wsplitpath.LIBCMT ref: 00436A45
      • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
    • __wsplitpath.LIBCMT ref: 00436A6C
    • __wcsicoll.LIBCMT ref: 00436A93
    • __wcsicoll.LIBCMT ref: 00436AB0
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
    • String ID:
    • API String ID: 1187119602-0
    • Opcode ID: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
    • Instruction ID: cc447ddabc085245cf6c6bda96777749177fc915bba42f20b5b260b799017f3a
    • Opcode Fuzzy Hash: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
    • Instruction Fuzzy Hash: 690165B64043416BD724EB50D881EEBB3ED7BD8304F04C91EB5C982041FB38D24C87A6
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _wcslen$_malloc_wcscat_wcscpy
    • String ID:
    • API String ID: 1597257046-0
    • Opcode ID: a0a60491a2b11ab92cb2618fcf1664bc73e22867390c023d5d6986141a6dc3e0
    • Instruction ID: 9df5ee2dcc5f1a759a9cde70f7b42babd8a8bdcc369222b22224423102f690bd
    • Opcode Fuzzy Hash: a0a60491a2b11ab92cb2618fcf1664bc73e22867390c023d5d6986141a6dc3e0
    • Instruction Fuzzy Hash: BFF06D32200200AFC314EB66C885E6BB3EAEBC5324F04852EF556C7791DB39F841C764
    APIs
    • DeleteObject.GDI32(?), ref: 0045564E
    • DeleteObject.GDI32(?), ref: 0045565C
    • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
    • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: DeleteDestroyObject$IconWindow
    • String ID:
    • API String ID: 3349847261-0
    • Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
    • Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
    • Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
    • Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D
    APIs
    • EnterCriticalSection.KERNEL32(?), ref: 0044B60B
    • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
    • LeaveCriticalSection.KERNEL32(?), ref: 0044B630
    • LeaveCriticalSection.KERNEL32(?), ref: 0044B641
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CriticalSection$Leave$EnterExchangeInterlocked
    • String ID:
    • API String ID: 2223660684-0
    • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
    • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
    • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
    • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
    APIs
      • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
      • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
      • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
      • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
      • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
    • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
    • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
    • EndPath.GDI32(?), ref: 004472B0
    • StrokePath.GDI32(?), ref: 004472BE
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
    • String ID:
    • API String ID: 2783949968-0
    • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
    • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
    • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
    • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
    APIs
    • __getptd.LIBCMT ref: 00417D1A
      • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
      • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
    • __getptd.LIBCMT ref: 00417D31
    • __amsg_exit.LIBCMT ref: 00417D3F
    • __lock.LIBCMT ref: 00417D4F
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: __amsg_exit__getptd$__getptd_noexit__lock
    • String ID:
    • API String ID: 3521780317-0
    • Opcode ID: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
    • Instruction ID: 784cd6646040312d8c3929352b57c791f513dbd9ce30c249d09a92555f0e5bc7
    • Opcode Fuzzy Hash: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
    • Instruction Fuzzy Hash: D4F06D319447089AD720FB66E4067EA32B0AF01728F11856FA4415B7D2DB3C99C08B9E
    APIs
    • GetDesktopWindow.USER32 ref: 00471144
    • GetDC.USER32(00000000), ref: 0047114D
    • GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
    • ReleaseDC.USER32(00000000,?), ref: 0047117B
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CapsDesktopDeviceReleaseWindow
    • String ID:
    • API String ID: 2889604237-0
    • Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
    • Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
    • Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
    • Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99
    APIs
    • GetDesktopWindow.USER32 ref: 00471102
    • GetDC.USER32(00000000), ref: 0047110B
    • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
    • ReleaseDC.USER32(00000000,?), ref: 00471139
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CapsDesktopDeviceReleaseWindow
    • String ID:
    • API String ID: 2889604237-0
    • Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
    • Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
    • Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
    • Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99
    APIs
    • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
    • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
    • GetCurrentThreadId.KERNEL32 ref: 004389DA
    • AttachThreadInput.USER32(00000000), ref: 004389E1
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
    • String ID:
    • API String ID: 2710830443-0
    • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
    • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
    • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
    • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
    APIs
    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
    • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
    • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
    • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0
      • Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
      • Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
    • String ID:
    • API String ID: 146765662-0
    • Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
    • Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
    • Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
    • Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65
    APIs
    • __IsNonwritableInCurrentImage.LIBCMT ref: 00414070
      • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
    • __getptd_noexit.LIBCMT ref: 00414080
    • __freeptd.LIBCMT ref: 0041408A
    • ExitThread.KERNEL32 ref: 00414093
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
    • String ID:
    • API String ID: 3182216644-0
    • Opcode ID: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
    • Instruction ID: 8c1b811a677bc0208766d104aadce1409d27245c16b3af4a320e27a455eae914
    • Opcode Fuzzy Hash: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
    • Instruction Fuzzy Hash: F8D0EC7051024256D6207BA7ED097AA3A589B44B26B15446EA905801B1DF68D9C1862D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: BuffCharLower
    • String ID: $8'I
    • API String ID: 2358735015-3608026889
    • Opcode ID: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
    • Instruction ID: 1bf34105e022c250dd7240f1ea7ec4803edb57b208c13e69c3fb06210d7c4844
    • Opcode Fuzzy Hash: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
    • Instruction Fuzzy Hash: 9FE1AE745043018BCB24EF16D88166BB7E4BF94348F40482FF88597292EB79DD89CB9B
    APIs
    • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
      • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
      • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
      • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
      • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
      • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
      • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: CopyVariant$ContainedObject$ErrorLast_malloc
    • String ID: AutoIt3GUI$Container
    • API String ID: 3380330463-3941886329
    • Opcode ID: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
    • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
    • Opcode Fuzzy Hash: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
    • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
    APIs
    • _wcslen.LIBCMT ref: 00409A61
      • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
      • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
      • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
      • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
    • CharUpperBuffW.USER32(?,?), ref: 00409AF5
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
    • String ID: 0vH
    • API String ID: 1143807570-3662162768
    • Opcode ID: bf773a96792e7386fbbaa0db16cdf7f70de857e2ea7db1c9c90ef838773f5a19
    • Instruction ID: 5e67718e4417cbef977f4cc7974cb0b4b39b480e5382bb1977b3cac956c07efc
    • Opcode Fuzzy Hash: bf773a96792e7386fbbaa0db16cdf7f70de857e2ea7db1c9c90ef838773f5a19
    • Instruction Fuzzy Hash: 53515BB1A083009FC718CF18C48065BB7E1FF88314F54856EF9999B391D779E942CB96
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID: HH$HH
    • API String ID: 0-1787419579
    • Opcode ID: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
    • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
    • Opcode Fuzzy Hash: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
    • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: InfoItemMenu_memset
    • String ID: 0
    • API String ID: 2223754486-4108050209
    • Opcode ID: 60781951bb834b78e0167a3e9afe01c70176745dc522d898366d6ad0e6242f51
    • Instruction ID: 143d79469fb3e570aa9bb1e7a79db7ad77638f8ab3c2e89d41e08a42c99b444e
    • Opcode Fuzzy Hash: 60781951bb834b78e0167a3e9afe01c70176745dc522d898366d6ad0e6242f51
    • Instruction Fuzzy Hash: CB3101721043009BF3249F18DC85BABBBE4EBC6310F14081FFA90C62A0E379D949C75A
    APIs
    • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
    • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend
    • String ID: '
    • API String ID: 3850602802-1997036262
    • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
    • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
    • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
    • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID:
    • String ID: 0
    • API String ID: 0-4108050209
    • Opcode ID: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
    • Instruction ID: 268d240ecd79f719a1425e83c09d650ed443e1bf0ac8ef4f8d51517adc50c1d2
    • Opcode Fuzzy Hash: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
    • Instruction Fuzzy Hash: B6210D765042206BEB15DF08D844B97B7A4FBDA310F44492BEE9897250D379E848C7AA
    APIs
    • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
    • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend
    • String ID: Combobox
    • API String ID: 3850602802-2096851135
    • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
    • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
    • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
    • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
    APIs
    • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
    • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: LengthMessageSendTextWindow
    • String ID: edit
    • API String ID: 2978978980-2167791130
    • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
    • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
    • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
    • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
    APIs
    • Sleep.KERNEL32(00000000), ref: 00474833
    • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: GlobalMemorySleepStatus
    • String ID: @
    • API String ID: 2783356886-2766056989
    • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
    • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
    • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
    • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: htonsinet_addr
    • String ID: 255.255.255.255
    • API String ID: 3832099526-2422070025
    • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
    • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
    • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
    • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
    APIs
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend_wcslen
    • String ID: ComboBox$ListBox
    • API String ID: 455545452-1403004172
    • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
    • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
    • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
    • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
    APIs
    • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: InternetOpen
    • String ID: <local>
    • API String ID: 2038078732-4266983199
    • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
    • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
    • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
    • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
    APIs
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend_wcslen
    • String ID: ComboBox$ListBox
    • API String ID: 455545452-1403004172
    • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
    • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
    • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
    • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
    APIs
      • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
    • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend_wcslen
    • String ID: ComboBox$ListBox
    • API String ID: 455545452-1403004172
    • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
    • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
    • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
    • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _strncmp
    • String ID: ,$UTF8)
    • API String ID: 909875538-2632631837
    • Opcode ID: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
    • Instruction ID: 35c0b5e4e6bd282640ba12729024cfd3588da47ca1ed1c49f01331a057b7ec9b
    • Opcode Fuzzy Hash: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
    • Instruction Fuzzy Hash: 7601B575A083805BE720DE20CC85BA773A1AB81319F58492ED8D5872A1F73DD449C75B
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: _strncmp
    • String ID: ,$UTF8)
    • API String ID: 909875538-2632631837
    • Opcode ID: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
    • Instruction ID: b3c6803870d1b21283bf32431af321d4190ac902c568a1d8b2e557ddf245ca97
    • Opcode Fuzzy Hash: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
    • Instruction Fuzzy Hash: 1E01D875A043805BE720DE20CC85B6773A19B4131AF68492FD8D6872A1F73DD449C75B
    APIs
    • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
      • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
    • wsprintfW.USER32 ref: 004560E9
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: MessageSend_mallocwsprintf
    • String ID: %d/%02d/%02d
    • API String ID: 1262938277-328681919
    • Opcode ID: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
    • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
    • Opcode Fuzzy Hash: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
    • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
    APIs
    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
    • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
      • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: FindMessagePostSleepWindow
    • String ID: Shell_TrayWnd
    • API String ID: 529655941-2988720461
    • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
    • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
    • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
    • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
    APIs
    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
    • PostMessageW.USER32(00000000), ref: 00442247
      • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: FindMessagePostSleepWindow
    • String ID: Shell_TrayWnd
    • API String ID: 529655941-2988720461
    • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
    • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
    • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
    • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
    APIs
    • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
      • Part of subcall function 00411A1F: _doexit.LIBCMT ref: 00411A2B
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.1256395001.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.1256380577.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256441594.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256461255.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.1256495163.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_PGHPC-10-0033-FZB-001.jbxd
    Similarity
    • API ID: Message_doexit
    • String ID: AutoIt$Error allocating memory.
    • API String ID: 1993061046-4017498283
    • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
    • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
    • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
    • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E